Code & Engineering skills

Finds the loops behind a bill spike or an unexpected bill. Reviews a web app's code and config for loops and repeats that run up the bill on their own on Vercel, Turso, Cloudflare Workers and D1 and paid AI APIs. Finds two schedulers on one job, retries without a cap, work that triggers itself, client polling and React render loops, caches cleared on every write, middleware running on every static file, queues that resend failures forever, image settings that multiply transformations, health checks that count whole tables, alerts sent on every run and bots crawling endless filter URLs. Counts the runs per month, names the billed unit, ranks by cost and gives the change that stops each one. Use when asked why a Vercel, Turso or Cloudflare bill jumped, to find an infinite loop or a runaway cost, or to review a cron job, webhook, queue consumer, middleware or polling code before it ships.

Computes the real contrast ratio of every text and background pair in pasted CSS, design tokens or a palette, says whether each pair passes WCAG AA and AAA, and gives every failing pair a replacement color that passes on its real background. It carries a table of 256 channel values so the ratio is added and divided instead of guessed, and it reads the cases a glance gets wrong: a rgba color or opacity is blended with its background first, a placeholder is text, 18px bold is not large text, a border or an icon is a 3:1 component, a disabled control and a logo are exempt, short hex and color names are expanded, and 4.48 is never rounded up to 4.5. One line per pair, then a Verdict line. Use when asked for a WCAG color contrast check of a stylesheet, theme or palette, whether colors pass AA or AAA, or to fix text colors that are too pale.

Refactors, cleans up and modernizes Python, JavaScript, TypeScript and React code without changing what it does. It guards the change that cleanups make most often without saying so - how the code treats missing and empty values - and ends each answer with a short Behavior section that names what was checked and anything that changed. Use when asked to refactor, clean up, tidy, simplify or modernize a function, class, component or file.

Reviews pasted application code, scripts and config for the four ways a secret leaks from the code that uses it, and lists only those, one line each with a fixed code, the place, who can then read the secret and the fix - or exactly No findings. It catches a secret value written to a log or printed (the key itself, an object or environment dump that contains it), a secret placed in a URL query string, a secret typed into source or a committed file, and a server secret sent to the browser through a public environment prefix or a prop of a client component. It leaves out the safe look-alikes: printing only that a key is present, its length or its last four characters, a publishable key that is public by design, and a secret read from the environment on the server. Use to review code that calls an API with a key, to check a Next.js or Vite project before release, or to gate a pull request that touches credentials.

Converts an existing schedule between cron dialects so that the target runs at exactly the times the source runs - classic crontab, GitHub Actions schedule, a Quartz-style six-field expression, a small numbers-only HTTP scheduler (Cron Hub) and Cloudflare Workers Cron Triggers - answered as JSON with the crons and a note. Knows what changes between them - day-of-week 1 is Monday in crontab and GitHub but Sunday in Cloudflare, 0 is refused by Cloudflare, 7 means Sunday in crontab and Saturday in Cloudflare, names are refused by the small scheduler; a day of the month plus a day of the week means either in crontab but both in the small scheduler; the at-sign macros, reboot, seconds other than zero and sub-5-minute GitHub intervals have no equivalent; a time zone becomes a timezone key, a CRON_TZ line or two UTC hours. Refuses what cannot be run at the same times. Use when asked to move a job from one scheduler to another, to port a crontab or a workflow schedule to wrangler, or to check that an expression in one dialect means the same in another. For a schedule given in words, use cron-schedule instead.

Turns the props of a UI component (a TypeScript type or a list of props) into strict JSON test data that stresses how it displays, and nothing else. Per prop it picks the worst values for the type, a string that is empty, one word of eighty characters with no space, on two lines, an emoji joined with a zero-width joiner, right-to-left letters or HTML-looking text, numbers at zero and at the large and decimal ends, lists that are empty, hold one item or hold a hundred, optional props left out, and dates at the far ends and across a time-zone edge. Every fixture still fits the declared type: a required prop is never missing, an enum gets only its values, a documented range is never broken, and callbacks are named apart from the data. Use to build fixtures for a component story, a visual test or a layout check, or to find what breaks a card, a list row or a badge.

Writes the response headers a site is missing, in the format of the person's own host, and keeps the page working. It reads the report line, the current response headers, the file that sets headers and the served head, and gives one line per finding with a fixed code, then a Headers block and a Verify line. It covers a missing or short Strict-Transport-Security, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count) and a server version in a header. It enforces only directives that cannot break rendering; script, style, image, font and connect sources go into a Report-Only header built from the origins in the pasted head. It leaves out safe look-alikes: unsafe-inline in style-src only, a long max-age without preload, SAMEORIGIN, a Server header with no number and a missing Referrer-Policy. Exactly No findings. when all is well. Use when a site check reports missing security headers, no HSTS, a short HSTS max-age or a version number in a response header.

Reviews pasted CSS, Tailwind classes or JSX styles for the motion mistakes that hurt real visitors, and lists only those, one line each with a fixed code, the place, why it matters and the fix - or exactly No findings. It catches movement that starts by itself, runs longer than five seconds and has no pause control, which fails WCAG 2.2.2 at Level A, large scaling or panning motion with no reduced-motion rule anywhere, a reduced-motion rule that leaves the large motion running, and layout properties such as height or top animated where transform fits. It leaves out the safe look-alikes, such as a short opacity fade on hover, a transform-only animation, and a reduced-motion rule that really switches the motion off. Use to review the styles of a page section before release, to check a hero, marquee, carousel or accordion for motion safety, or to gate a pull request that adds animation.

Reviews the HTML or JSX of one form for four input mistakes that frustrate people while they type, and lists only those, one line each with a fixed code, the field, why it hurts the user and the fix - or exactly No findings. It catches paste blocked on a password field, a field that holds a code, a ZIP code or a card number set to type number, or an email address or phone number left as plain text with no type or input mode, autocomplete switched off or given a wrong token on password, username and one-time-code fields, and a submit button disabled until the whole form is valid so the person never learns what is missing. It leaves out the safe look-alikes: a real quantity as type number with a minimum and a maximum, autocomplete off on a site search box, and a button disabled only while the request is running. Use to review a sign-in, sign-up, checkout or contact form before release, or to find why mobile keyboards and password managers misbehave.

Reviews pasted React and Next.js App Router code for five performance mistakes that pass every test and then make pages slow, and lists only those, one line each with a fixed code, the place, why it costs time and the fix - or exactly No findings. It catches independent awaits written one after another so the page waits for their sum, an effect that copies something derivable during render into state, a use client mark placed on a whole page when only a small leaf needs interactivity, a heavy library imported at the top of a client file though it is used only after a click, and a new object, array or function passed every render to a memo child or an effect dependency. It leaves out the safe look-alikes: a second await that needs the first result, an effect that syncs with an outside system, and use client on a small button. Use to review React or Next.js code before release, to find why a page ships too much JavaScript or renders twice, or to gate a pull request that touches components.

Reviews pasted Remotion code (React video compositions) for the five mistakes that make a render differ from the preview or come out with missing frames, and lists only those, one line each with a fixed code, the place, why it breaks the render and the fix - or exactly No findings. It catches motion that is not driven by the frame number (CSS transitions and keyframes, timers, requestAnimationFrame, a counter held in state), Math.random in a component instead of the seeded random function, plain img, video, audio and iframe tags that the render does not wait for, data fetched in an effect with no render delay and no calculateMetadata, and a file from the public folder referenced by a bare path instead of staticFile. It leaves out safe look-alikes: clamped interpolate, seeded random, Math.random in a Node script. Use to review a Remotion composition before rendering, to debug flicker or a video that differs between renders, or to gate a pull request that edits a video project.

Converts PostgreSQL or MySQL schema statements, migrations and queries into SQLite that Cloudflare D1 and Turso run, so the converted version behaves like the original and not only parses. Knows the conversions that run without an error and then go wrong - a key written as BIGSERIAL or INT AUTO_INCREMENT that SQLite stores as NULL, a custom enum type or an inline enum that stops checking anything, a default now() or gen_random_uuid() that SQLite rejects, a unique email that was case-insensitive in MySQL, ON UPDATE CURRENT_TIMESTAMP that needs a trigger, a foreign key added later with ALTER TABLE, a schema prefix, DISTINCT ON, ILIKE, double-colon casts, date_trunc, interval arithmetic, DATEDIFF, GROUP_CONCAT with SEPARATOR, MySQL division that keeps the fraction, ON DUPLICATE KEY UPDATE, JSON operators. Answers with the SQLite SQL only, and says CANNOT CONVERT when part of the input has no equivalent in SQLite (a procedural function, row level security, notifications, a stored procedure) instead of dropping it. Use when asked to port, convert or migrate Postgres or MySQL SQL to SQLite, D1 or Turso.

Reviews ONE test file for the five causes that make a test pass on one run and fail on the next, and lists only those, one line each with a fixed code, the test, why it flips and the fix - or exactly No findings. It catches a fixed sleep used to wait for background work, an expectation tied to today's date or the current time, tests that share state and only pass in one order, random values with no fixed seed, and a call to a real network address. It leaves out the safe look-alikes, such as a fake clock set before the call, a random generator built from a fixed seed, a mocked network module and fake timers moved by hand. Use to find why a test fails once in a while in CI, to review a new test file before merging, or to harden a suite that people re-run until it goes green.

Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directive, why it hurts and the fix - or exactly No findings. It catches unsafe-eval or unsafe-inline in the script directive, a star, a data source or a bare scheme as a script source, a policy with neither object-src nor a default-src, a missing base-uri, a missing frame-ancestors, and a report-only header that the note describes as blocking. It leaves out the safe look-alikes, such as unsafe-inline in style-src only, unsafe-inline beside a nonce, a nonce with strict-dynamic, and a data source for images. Use to review a CSP before rollout, to audit the headers of a site, or to check a policy copied from a tutorial.

Reviews the Set-Cookie headers of a response, or the code that sets them, and lists only the attribute mistakes that expose a login cookie, one line each with a fixed code, the cookie, why it hurts and the fix - or exactly No findings. It catches a session cookie sent without Secure, a session cookie that script can read because HttpOnly is missing, SameSite=None without Secure, a __Host- cookie that carries a Domain or a Path other than the root, a Domain attribute wider than the host that needs the cookie, and a login cookie that lives for months. It leaves out the safe look-alikes, such as a theme or language cookie that script reads, a missing SameSite attribute, and SameSite=None together with Secure. Use to review the cookies of a login flow, to audit a framework's cookie settings, or before a security review of a web app.

Reviews ONE OAuth 2.0 or OpenID Connect sign-in flow written in code for the four mistakes that let an attacker steal a login or a token, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches a state value that is never compared or not tied to the user's session, a browser or mobile client that sends no PKCE challenge, a redirect address matched by prefix or substring, and an implicit flow or an access token carried in a URL. It leaves out the safe look-alikes, such as a state kept in a cookie and compared, an exact redirect match, a server-side client with a secret, and a token sent in a header. Use to review a login integration, to audit a single-page app before launch, or to check a gateway that handles redirects.

Reviews ONE PostgreSQL migration file for the four statements that lock or rewrite a table that is already in use, and lists only those, one line each with a fixed code, the statement, why it hurts and the fix - or exactly No findings. It catches CREATE INDEX without CONCURRENTLY on an existing table, a not-null or constraint check run in one blocking step, a column type change or volatile default that rewrites the table, and a drop or rename of a column that running code may still read. It leaves out the safe look-alikes, such as an index built concurrently, a column added with a constant default, a constraint added NOT VALID and validated separately, and the drop of a column the file says nothing reads. Use to review a migration before deploy, to plan a zero-downtime change, or to check a schema pull request.

Reviews ONE piece of code that verifies JSON Web Tokens for the five mistakes that let a forged or stale token in, and lists only those, one line each with a fixed code, the function, why it hurts and the fix - or exactly No findings. It catches an algorithm taken from the token header or no fixed algorithm list, an expiry check switched off, neither audience nor issuer checked, a payload read with decode where verify is needed, and a signing secret written into the source. It leaves out the safe look-alikes, such as an algorithm list fixed in the verify call, an audience compared in a second step, and a decode that only reads the key id. Use to review login middleware, to audit token handling in a service, or to check an API before release.

Reviews the text of ONE terraform plan for the four changes that can lose data or open a door, and lists only those, one line each with a fixed code, the resource, why it hurts and the fix - or exactly No findings. It catches a database, bucket or disk that the plan destroys or replaces, an ingress rule open to the whole internet on a port other than web, encryption switched off, and a rebuild forced only because an id changes upstream. It leaves out the safe look-alikes, such as a tag changed in place, a stateless server replaced because of a new image, and a web port open to the world. Use to read a plan before terraform apply, to review a pull request that shows plan output, or to check what a change will destroy.

Reviews ONE Kubernetes Pod or Deployment manifest for the five settings that most often make a workload unsafe or unpredictable, and lists only those, one line each with a fixed code, the container or volume, why it hurts and the fix - or exactly No findings. It catches a container that is privileged or may run as root, an image with no tag or the latest tag, a container with no memory limit, a secret value written as a literal in env, and a hostPath volume. It leaves out the safe look-alikes, such as a pod that sets runAsNonRoot, an image pinned by digest, a read-only configMap volume and a secret read through secretKeyRef. Use to review a manifest before it is applied, to audit a repository of deployments, or to check a Pod that keeps being killed.

Reviews CORS code or server configuration (an Express or Flask handler, an nginx block, a framework setting) for the five mistakes that let a hostile web page read private responses, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a request Origin copied into the allow header while cookies are allowed, a wildcard origin together with credentials, the null origin allowed, an origin check by suffix, substring or an unanchored pattern, and a per-origin allow header sent without Vary Origin. It leaves out the safe look-alikes, such as an exact allow-list with credentials and a public read-only API that answers with a wildcard and no credentials. Use to review CORS code before release, to audit a gateway config, or to debug a browser CORS error that looks like a server mistake.

Reviews ONE AWS IAM policy (an identity policy, or a bucket policy) written as JSON for the five grants that hand out far more than a job needs, and lists only those, one line each with a fixed code, the statement, why it is dangerous and the fix - or exactly No findings. It catches every action on every resource or a whole service on every resource, iam:PassRole on any role, Allow combined with NotAction, a public principal with no condition, and actions that let a holder raise their own rights such as creating a policy version or attaching a policy. It leaves out the safe look-alikes, such as a public principal narrowed to an organization, read-only access to one bucket, and a Deny with NotAction. Use to review a policy before attaching it, to audit a role, or to check a bucket policy for public access.

Reviews ONE Dockerfile for the five build mistakes that cost security or build time, and lists only those, one line each with a fixed code, the instruction, why it hurts and the fix - or exactly No findings. It catches a final image that runs as root, a base image with no tag or the latest tag, a secret passed through an argument, an environment value or a file copy so that it stays in the image history, source copied in before the dependencies are installed so the cache is lost on every edit, and the package index left in the layer after apt-get. It leaves out the safe look-alikes, such as a build secret mounted for one instruction, a tag pinned by digest, and root in a build stage that never ships. Use to review a Dockerfile before merging, to audit the images of a repository, or to speed up a slow image build.

Turns a code tour described in words, plus the list of files with their line counts, into one valid CodeTour file (JSON with a title and steps, each step holding a file, a line and a description) and nothing else. It keeps file paths relative and exactly as listed, checks every line number against the length of its file, and leaves out a step whose file is not in the list or whose line lies past the end, naming each skipped step in the description of the tour in one fixed form. A tour with only valid steps carries no mention of skipping. Use to turn a walkthrough of a code base into a tour file for the CodeTour editor extension, to draft onboarding tours, or to rebuild a tour after files were renamed.