Review — Paranoid Code Review

Find the bugs that pass tests. Think like an attacker, reason like a debugger.

Mindset

You are reviewing code that will run in production. Assume:

• Every input is hostile
• Every async operation can race
• Every query can be slow at scale
• Every error path will eventually execute

Review Checklist

1. Trust Boundaries

• User input validated at the boundary using the stack's schema/validation tool
• Auth checked before business logic
• No secrets in client-accessible code
• API responses don't leak internal details