Use when deciding the verdict of a security review - severity anchors and confidence scale, when to block, approve with notes, add a needs-validation note, drop or reject as unreviewable, the smallest-fix rule and the exact comment templates
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff calls a model, exposes a tool to one, feeds it fetched or user content, renders or executes its output, stores agent memory or conversation history, asks a user to approve an agent action, routes MCP tools, or changes agent settings, MCP configs, tool policies or prompt files - including this platform's own agents
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a candidate finding falls into a noisy category - the do-not-report list, the precedents that settle recurring edge cases, and the narrow exceptions where an excluded category still counts
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing iOS (Swift), Android (Kotlin) or Flutter changes - token storage, ATS and cleartext config, TLS trust, exported components, deep links, WebView JavaScript bridges, certificate pinning claims, secrets bundled in the app, Firebase rules
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing Java or Kotlin server changes on Spring or Quarkus - security config and method security, JPA/JPQL and JdbcTemplate queries, request binding, deserialization, XML parsers, SpEL, templates, Actuator, JNDI and reflection
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing Node.js or TypeScript server code - Express/Fastify/Nest handlers, Next.js server actions and route handlers, child_process, ORM raw queries, prototype pollution, template engines, JWT and outbound HTTP clients
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff adds, upgrades, re-sources or re-pins a dependency - manifests, lockfiles, go.mod replace, Docker base images, GitHub Actions uses, Terraform modules, submodules, vendored or generated code, curl-pipe-sh installs - or changes what goes into a package or image, how releases are signed and verified, or how an updater or plugin loader trusts what it installs
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you draw a screen as HTML mockup documents (one per variant) - the sanitizer-safe recipe, phone and wide frames, the states grid, static control states, and the loopback self-check with screenshots at 375, 768 and 1440 attached to the task
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing Go changes - net/http and Fiber handlers, database/sql and GORM queries, os/exec, filepath and os.Root, html/template, crypto, TLS and SSH clients, JSON binding
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you derive, change or extend a design system - where tokens live per stack, the DTCG token tree, role-based names for both themes, base vs layer vs drift, the DESIGN.md section order, the inventory format, the contrast check and the lint every proposal returns
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a screen design was approved (the design task is in done) - the hand-off document implementers build from - components mapped to the inventory, tokens, every state, responsive behaviour per breakpoint, accessibility notes and exact copy
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff builds a query, a shell command or argv, a subprocess environment, a template, an XML parse, an eval or a deserialization from data that may be attacker-controlled - SQL/NoSQL, OS command, argument, env-var, template and code injection, XXE, unsafe deserialization
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a design task asks you to compare a built screen with its approved design - screenshots at 1440, 768 and 375 attached to the task, Blocker/High/Medium/Nitpick triage, evidence per finding, problems not prescriptions
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff renders user-controlled content as HTML, builds links or redirects, changes CSP or CORS, adds a cookie-authenticated state change or WebSocket, a postMessage handler, a markdown renderer, a service worker, browser storage of tokens or private data, a frameable sensitive action, or an Electron/Tauri window
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing Python changes - Django, Flask and FastAPI handlers, subprocess, SQL, Jinja2, format strings, and data/ML code that loads pickles, models, notebooks or remote model code
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you write any words a user reads in a mockup or a hand-off - content language and voice, buttons, labels, errors, empty states, confirmations, numbers and dates, and the longest-string check
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the server side of the diff fetches, renders, redirects to or validates a URL that input can influence - webhooks, link previews, import-from-URL, PDF renderers, OAuth/JWKS discovery, allowlist and blocklist checks
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a screen design needs variants - how many, one document per variant, what makes two variants genuinely different, recommending one, how the human's choice is read, and narrowing to the chosen one in revision
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff adds or moves a credential, logs or returns data, builds a URL or argv with a token, generates a random value, encrypts, signs, hashes, configures TLS or writes a credential file
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff builds a filesystem path from input, extracts an archive, accepts an upload, serves a file or writes a temp file - traversal, symlinks, zip-slip, upload type and served content-type
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when you have a candidate security finding and before it goes in a comment - restate it as a crossed boundary, prove reachability, impact and a concrete exploit, apply triage dismissals, route out-of-repository facts to needs-validation, keep the effect no stronger than the trace, then the self-refute and verifier passes
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when reviewing game code in C#, GDScript or C++ (Unity, Godot, Unreal, custom engines) - client vs server authority, RPC and packet validation, in-app purchases and economy, save and replay files, mod and script loading, secrets in client builds
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA/IDOR, function-level authorization, mass assignment and tenant scoping
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.