1---2name: fresh-eyes-review3description: Use when about to commit, create a PR, or declare work complete — after verification-before-completion confirms tests pass but before code ships. Catches security vulnerabilities, logic errors, and business rule bugs that slip through despite passing tests.4---56# Fresh-Eyes Review78## Overview910Deliberate re-reading of changed code with psychological distance. Catches what you assumed was correct.1112**Core principle:** 100% test coverage can coexist with critical bugs.1314**Prerequisite:** `verification-before-completion` must pass first.1516## Process17181. **Announce:** "Starting fresh-eyes review of [N] files."192. **Walk each changed file** through the five checklists below.203. **Fix immediately.** Re-run tests after each fix.214. **Declare:** "Fresh-eyes complete. [N] issues found and fixed: [brief description of each]." Include this even for zero findings.2223## Checklists2425### Security2627| Check | Look For |28|-------|----------|29| Injection | Unsanitized input in queries, commands, or templates |30| Path traversal | Unvalidated file paths, `../` sequences |31| Auth gaps | Unprotected endpoints, missing authorization checks |32| Secrets | Hardcoded credentials, tokens, or keys |3334### Logic3536| Check | Look For |37|-------|----------|38| Boundaries | Off-by-one in indices, loops, pagination |39| Race conditions | Concurrent access to shared state |40| Null handling | Unguarded access chains that could throw |41| Error swallowing | Empty catch blocks, ignored rejections |4243### Business Rules4445| Check | Look For |46|-------|----------|47| Calculations | Formulas matching requirements, correct rounding |48| Conditions | AND/OR logic correct, negations applied properly |49| Edge cases | Empty input, single item, zero, maximum values |50| Defaults | Sensible values when optional fields omitted |5152### Input Validation5354| Check | Look For |55|-------|----------|56| Type checks | Expected types enforced at boundaries |57| Range checks | Numeric bounds, string lengths, array sizes |58| Format checks | Email, URL, date formats validated |5960### Performance6162| Check | Look For |63|-------|----------|64| N+1 queries | Loops making individual database/API calls |65| Unbounded work | Missing limits on iterations, result sets, payloads |66| Resource leaks | Unclosed connections, streams, event listeners |6768## Resistance Patterns6970| Rationalization | Reality |71|-----------------|---------|72| "Tests are comprehensive" | Tests validate design, not correctness |73| "I'm confident it's correct" | Confidence is inversely correlated with bugs |74| "It's just a small change" | Small changes cause large outages |75| "Partner is waiting" | 3 minutes now saves 3 hours debugging later |76| "Senior dev already approved" | They reviewed intent, not implementation details |77| "Production is blocked" | Rushing causes the outages being rushed to fix |7879## Red Flags — STOP8081- "I already looked at this code while writing it"82- "The tests cover everything"83- "This is too trivial to review"84- "I just need to commit this quickly"
michellepellon