Find Bugs

Review changes on this branch for bugs, security vulnerabilities, and code quality issues.

Phase 1: Complete Input Gathering

• Get the FULL diff: git diff master...HEAD
• If output is truncated, read each changed file individually until you have seen every changed line
• List all files modified in this branch before proceeding

Phase 2: Attack Surface Mapping

For each changed file, identify and list:

• All user inputs (request params, headers, body, URL components)
• All database queries
• All authentication/authorization checks
• All session/state operations
• All external calls
• All cryptographic operations

Phase 3: Security Checklist (check EVERY item for EVERY file)

• Injection: SQL, command, template, header injection
• XSS: All outputs in templates properly escaped?
• Authentication: Auth checks on all protected operations?
• Authorization/IDOR: Access control verified, not just auth?
• CSRF: State-changing operations protected?
• Race conditions: TOCTOU in any read-then-write patterns?
• Session: Fixation, expiration, secure flags?
• Cryptography: Secure random, proper algorithms, no secrets in logs?
• Information disclosure: Error messages, logs, timing attacks?
• DoS: Unbounded operations, missing rate limits, resource exhaustion?
• Business logic: Edge cases, state machine violations, numeric overflow?

Phase 4: Verification

For each potential issue:

• Check if it's already handled elsewhere in the changed code
• Search for existing tests covering the scenario
• Read surrounding context to verify the issue is real

Phase 5: Pre-Conclusion Audit

Before finalizing, you MUST:

• List every file you reviewed and confirm you read it completely
• List every checklist item and note whether you found issues or confirmed it's clean
• List any areas you could NOT fully verify and why
• Only then provide your final findings

Output Format

Prioritize: security vulnerabilities > bugs > code quality Skip: stylistic/formatting issues

For each issue:

• File:Line - Brief description
• Severity: Critical/High/Medium/Low
• Problem: What's wrong
• Evidence: Why this is real (not already fixed, no existing test, etc.)
• Fix: Concrete suggestion
• References: OWASP, RFCs, or other standards if applicable

If you find nothing significant, say so - don't invent issues.

Do not make changes - just report findings. I'll decide what to address.