Code review: security and performance leaks
Compare the current branch against main. Examine only the changed files.
Look for leaks, not style.
Steps
- List changed files only:
git diff --name-only main...HEAD
- Read the full diff for those files:
git diff main...HEAD -- <file> ...
Do not scan files outside this list.
- Check each changed file for security leaks:
- Secrets, keys, tokens, or credentials committed in the diff.
- User input reaching a query, shell command, file path, or template without
escaping or parameterization (SQLi, command injection, path traversal, XSS).
- New logging or error output that includes secrets, tokens, PII, or full
request bodies.
- Auth or permission checks removed, weakened, or skipped on a code path that
had one before.
- New network calls or dependencies with an unvalidated or attacker-controlled
destination (SSRF).
- Check each changed file for performance leaks:
- A resource opened (file, socket, DB connection, lock) with no matching
close/release on every path, including error paths.
- A query or loop newly added inside another loop (N+1).
- An unbounded cache, list, or buffer that grows with request volume and is
never evicted.
- A blocking call added on a hot or latency-sensitive path.
- Ignore correctness-vs-claim and naming/style — that is a different skill's job.
Report
List each finding as: file:line, one-line description, why it is a leak. If
nothing found, say so plainly. Do not propose fixes unless asked.
1---2name: code-review-leaks3description: Review the current branch's diff against main for security and performance leaks — only in the changed files. Use when the user asks to review a PR, review changes, check for security issues, or check for performance regressions.4---56# Code review: security and performance leaks78Compare the current branch against `main`. Examine only the changed files.9Look for leaks, not style.1011## Steps12131. List changed files only:14 ```bash15 git diff --name-only main...HEAD16 ```172. Read the full diff for those files:18 ```bash19 git diff main...HEAD -- <file> ...20 ```21 Do not scan files outside this list.223. Check each changed file for security leaks:23 - Secrets, keys, tokens, or credentials committed in the diff.24 - User input reaching a query, shell command, file path, or template without25 escaping or parameterization (SQLi, command injection, path traversal, XSS).26 - New logging or error output that includes secrets, tokens, PII, or full27 request bodies.28 - Auth or permission checks removed, weakened, or skipped on a code path that29 had one before.30 - New network calls or dependencies with an unvalidated or attacker-controlled31 destination (SSRF).324. Check each changed file for performance leaks:33 - A resource opened (file, socket, DB connection, lock) with no matching34 close/release on every path, including error paths.35 - A query or loop newly added inside another loop (N+1).36 - An unbounded cache, list, or buffer that grows with request volume and is37 never evicted.38 - A blocking call added on a hot or latency-sensitive path.395. Ignore correctness-vs-claim and naming/style — that is a different skill's job.4041## Report4243List each finding as: file:line, one-line description, why it is a leak. If44nothing found, say so plainly. Do not propose fixes unless asked.
TDAK1509