Query Review

Review an authorized codebase for ORM misuse, N+1 query patterns, authorization-after-fetch bugs, raw SQL risks, cache key collisions, and missing tenant scopes. Use for data-access layers and security-adjacent performance pitfalls.

MuhammedZohaib 884ba88 692 B Updated

File contents

Query Review

Focus

  • missing tenant scopes
  • authorization after broad fetches
  • raw SQL without parameter binding
  • N+1 patterns that become availability or side-channel issues
  • eager loads that overexpose sensitive associations
  • cache keys missing tenant or role context

Heuristic

Treat data-access issues as security-relevant when they change scope, leak metadata, or undermine availability controls.

MuhammedZohaib/patchman/tree/main/skills/query-review commit 884ba88b63

Frequently asked questions

npx skillmds@latest add muhammedzohaib/query-review