Use when deciding the verdict of a security review - severity anchors and confidence scale, when to block, approve with notes, add a needs-validation note, drop or reject as unreviewable, the smallest-fix rule and the exact comment templates
中文简介正在准备中。当前显示原文说明。
Use when the diff calls a model, exposes a tool to one, feeds it fetched or user content, renders or executes its output, stores agent memory or conversation history, asks a user to approve an agent action, routes MCP tools, or changes agent settings, MCP configs, tool policies or prompt files - including this platform's own agents
中文简介正在准备中。当前显示原文说明。
Use when a candidate finding falls into a noisy category - the do-not-report list, the precedents that settle recurring edge cases, and the narrow exceptions where an excluded category still counts
中文简介正在准备中。当前显示原文说明。
Use when reviewing iOS (Swift), Android (Kotlin) or Flutter changes - token storage, ATS and cleartext config, TLS trust, exported components, deep links, WebView JavaScript bridges, certificate pinning claims, secrets bundled in the app, Firebase rules
中文简介正在准备中。当前显示原文说明。
Use when reviewing Java or Kotlin server changes on Spring or Quarkus - security config and method security, JPA/JPQL and JdbcTemplate queries, request binding, deserialization, XML parsers, SpEL, templates, Actuator, JNDI and reflection
中文简介正在准备中。当前显示原文说明。
Use when reviewing Node.js or TypeScript server code - Express/Fastify/Nest handlers, Next.js server actions and route handlers, child_process, ORM raw queries, prototype pollution, template engines, JWT and outbound HTTP clients
中文简介正在准备中。当前显示原文说明。
Use when the diff adds, upgrades, re-sources or re-pins a dependency - manifests, lockfiles, go.mod replace, Docker base images, GitHub Actions uses, Terraform modules, submodules, vendored or generated code, curl-pipe-sh installs - or changes what goes into a package or image, how releases are signed and verified, or how an updater or plugin loader trusts what it installs
中文简介正在准备中。当前显示原文说明。
Use when you draw a screen as HTML mockup documents (one per variant) - the sanitizer-safe recipe, phone and wide frames, the states grid, static control states, and the loopback self-check with screenshots at 375, 768 and 1440 attached to the task
中文简介正在准备中。当前显示原文说明。
Use when reviewing Go changes - net/http and Fiber handlers, database/sql and GORM queries, os/exec, filepath and os.Root, html/template, crypto, TLS and SSH clients, JSON binding
中文简介正在准备中。当前显示原文说明。
Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged
中文简介正在准备中。当前显示原文说明。
Use when you derive, change or extend a design system - where tokens live per stack, the DTCG token tree, role-based names for both themes, base vs layer vs drift, the DESIGN.md section order, the inventory format, the contrast check and the lint every proposal returns
中文简介正在准备中。当前显示原文说明。
Use when a screen design was approved (the design task is in done) - the hand-off document implementers build from - components mapped to the inventory, tokens, every state, responsive behaviour per breakpoint, accessibility notes and exact copy
中文简介正在准备中。当前显示原文说明。
Use when the diff builds a query, a shell command or argv, a subprocess environment, a template, an XML parse, an eval or a deserialization from data that may be attacker-controlled - SQL/NoSQL, OS command, argument, env-var, template and code injection, XXE, unsafe deserialization
中文简介正在准备中。当前显示原文说明。
Use when a design task asks you to compare a built screen with its approved design - screenshots at 1440, 768 and 375 attached to the task, Blocker/High/Medium/Nitpick triage, evidence per finding, problems not prescriptions
中文简介正在准备中。当前显示原文说明。
Use when the diff renders user-controlled content as HTML, builds links or redirects, changes CSP or CORS, adds a cookie-authenticated state change or WebSocket, a postMessage handler, a markdown renderer, a service worker, browser storage of tokens or private data, a frameable sensitive action, or an Electron/Tauri window
中文简介正在准备中。当前显示原文说明。
Use when reviewing Python changes - Django, Flask and FastAPI handlers, subprocess, SQL, Jinja2, format strings, and data/ML code that loads pickles, models, notebooks or remote model code
中文简介正在准备中。当前显示原文说明。
Use when you write any words a user reads in a mockup or a hand-off - content language and voice, buttons, labels, errors, empty states, confirmations, numbers and dates, and the longest-string check
中文简介正在准备中。当前显示原文说明。
Use when the server side of the diff fetches, renders, redirects to or validates a URL that input can influence - webhooks, link previews, import-from-URL, PDF renderers, OAuth/JWKS discovery, allowlist and blocklist checks
中文简介正在准备中。当前显示原文说明。
Use when a screen design needs variants - how many, one document per variant, what makes two variants genuinely different, recommending one, how the human's choice is read, and narrowing to the chosen one in revision
中文简介正在准备中。当前显示原文说明。
Use when the diff adds or moves a credential, logs or returns data, builds a URL or argv with a token, generates a random value, encrypts, signs, hashes, configures TLS or writes a credential file
中文简介正在准备中。当前显示原文说明。
Use when the diff builds a filesystem path from input, extracts an archive, accepts an upload, serves a file or writes a temp file - traversal, symlinks, zip-slip, upload type and served content-type
中文简介正在准备中。当前显示原文说明。
Use when you have a candidate security finding and before it goes in a comment - restate it as a crossed boundary, prove reachability, impact and a concrete exploit, apply triage dismissals, route out-of-repository facts to needs-validation, keep the effect no stronger than the trace, then the self-refute and verifier passes
中文简介正在准备中。当前显示原文说明。
Use when reviewing game code in C#, GDScript or C++ (Unity, Godot, Unreal, custom engines) - client vs server authority, RPC and packet validation, in-app purchases and economy, save and replay files, mod and script loading, secrets in client builds
中文简介正在准备中。当前显示原文说明。
Use when the diff adds or changes an endpoint, resolver, RPC, job or query that takes an object id, a role check, a request binding or a tenant filter - BOLA/IDOR, function-level authorization, mass assignment and tenant scoping
中文简介正在准备中。当前显示原文说明。