🇺🇸English
Find Bugs
Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
Phase 1: Complete Input Gathering
- Get the FULL diff:
git diff master...HEAD
- If output is truncated, read each changed file individually until you have seen every changed line
- List all files modified in this branch before proceeding
Phase 2: Attack Surface Mapping
For each changed file, identify and list:
- All user inputs (request params, headers, body, URL components)
- All database queries
- All authentication/authorization checks
- All session/state operations
- All external calls
- All cryptographic operations
Phase 3: Security Checklist (check EVERY item for EVERY file)
- Injection : SQL, command, template, header injection
- XSS : All outputs in templates properly escaped?
- Authentication : Auth checks on all protected operations?
- Authorization/IDOR : Access control verified, not just auth?
- CSRF : State-changing operations protected?
- Race conditions : TOCTOU in any read-then-write patterns?
- Session : Fixation, expiration, secure flags?
- Cryptography : Secure random, proper algorithms, no secrets in logs?
- Information disclosure : Error messages, logs, timing attacks?
- DoS : Unbounded operations, missing rate limits, resource exhaustion?
- Business logic : Edge cases, state machine violations, numeric overflow?
Phase 4: Verification
For each potential issue:
- Check if it's already handled elsewhere in the changed code
- Search for existing tests covering the scenario
- Read surrounding context to verify the issue is real
Phase 5: Pre-Conclusion Audit
Before finalizing, you MUST:
- List every file you reviewed and confirm you read it completely
- List every checklist item and note whether you found issues or confirmed it's clean
- List any areas you could NOT fully verify and why
- Only then provide your final findings
Output Format
Prioritize : security vulnerabilities > bugs > code quality
Skip : stylistic/formatting issues
For each issue:
- File:Line - Brief description
- Severity : Critical/High/Medium/Low
- Problem : What's wrong
- Evidence : Why this is real (not already fixed, no existing test, etc.)
- Fix : Concrete suggestion
- References : OWASP, RFCs, or other standards if applicable
If you find nothing significant, say so - don't invent issues.
Do not make changes - just report findings. I'll decide what to address.
Weekly Installs
227
Repository
davila7/claude-…emplates
GitHub Stars
22.6K
First Seen
Jan 21, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
opencode171
gemini-cli170
claude-code167
codex152
cursor150
github-copilot139
