Security Checklist

Security Checklist【免费下载链接】agentsMulti-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, and Google Antigravity项目地址: https://gitcode.com/GitHub_Trending/agents24/agentsUser input validated and sanitizedSQL queries use parameterizationAuthentication/authorization checkedSecrets not hardcodedError messages dont leak infoPerformance ChecklistNo N1 queriesDatabase queries indexedLarge lists paginatedExpensive operations cachedNo blocking I/O in hot pathsTesting ChecklistHappy path testedEdge cases coveredError cases testedTest names are descriptiveTests are deterministic### 技巧 2提问法The Question Approach 用提问代替直接断言引导作者自己思考比直接给结论更有教育价值❌ This will fail if the list is empty. ✅ What happens ifitemsis an empty array?❌ You need error handling here. ✅ How should this behave if the API call fails?❌ This is inefficient. ✅ I see this loops through all users. Have we considered the performance impact with 100k users?### 技巧 3建议而非命令Suggest, Dont Command 使用协作式语言把你必须改变成我们是否可以考虑❌ You must change this to use async/await ✅ Suggestion: async/await might make this more readable: async function fetchUser(id: string) { const user await db.query(SELECT * FROM users WHERE id ?, id); return user; } What do you think?❌ Extract this into a function ✅ This logic appears in 3 places. Would it make sense to extract it into a shared utility function?### 技巧 4区分严重级别Differentiate Severity 用标签体系明确优先级让作者一眼知道哪些必须处理、哪些只是建议 markdown [blocking] - Must fix before merge [important] - Should fix, discuss if disagree [nit] - Nice to have, not blocking [suggestion] - Alternative approach to consider [learning] - Educational comment, no action needed [praise] - Good work, keep it up! Example: [blocking] This SQL query is vulnerable to injection. Please use parameterized queries. [nit] Consider renaming data to userData for clarity. [praise] Excellent test coverage! This will catch edge cases.这套严重级别体系在 pr-enhance 命令 的风险评估模块中也有呼应——其get_risk_level函数把风险分数映射为 Low / Medium / High / Critical 四级说明分级沟通已成为本仓库评审类工具的一致设计语言。语言特定评审模式Python 评审要点# ❌ Mutable default arguments def add_item(item, items[]): # Bug! Shared across calls items.append(item) return items # ✅ Use None as default def add_item(item, itemsNone): if items is None: items [] items.append(item) return items # ❌ Catching too broad try: result risky_operation() except: # Catches everything, even KeyboardInterrupt! pass # ✅ Catch specific exceptions try: result risky_operation() except ValueError as e: logger.error(fInvalid value: {e}) raise # ❌ Using mutable class attributes class User: permissions [] # Shared across all instances! # ✅ Initialize in __init__ class User: def __init__(self): self.permissions []TypeScript/JavaScript 评审要点// ❌ Using any defeats type safety function processData(data: any) { // Avoid any return data.value; } // ✅ Use proper types interface DataPayload { value: string; } function processData(data: DataPayload) { return data.value; } // ❌ Not handling async errors async function fetchUser(id: string) { const response await fetch(/api/users/${id}); return response.json(); // What if network fails? } // ✅ Handle errors properly async function fetchUser(id: string): PromiseUser { try { const response await fetch(/api/users/${id}); if (!response.ok) { throw new Error(HTTP ${response.status}); } return await response.json(); } catch (error) { console.error(Failed to fetch user:, error); throw error; } } // ❌ Mutation of props function UserProfile({ user }: Props) { user.lastViewed new Date(); // Mutating prop! return div{user.name}/div; } // ✅ Dont mutate props function UserProfile({ user, onView }: Props) { useEffect(() { onView(user.id); // Notify parent to update }, [user.id]); return div{user.name}/div; }高级评审模式模式 1架构评审Architectural Review针对重大变更先设计后实现、分阶段评审先要设计文档大型功能先产出设计文档并与团队确认方案避免返工分阶段评审第一个 PR 只评审核心抽象与接口第二个 PR 评审实现第三个 PR 评审集成与测试——更易评审、迭代更快考虑替代方案不断追问是否考虑过某模式/库与更简单方案相比的权衡是什么需求变化时它会如何演进模式 2测试质量评审Test Quality Review核心判据是测试行为而非实现细节// ❌ Poor test: Implementation detail testing test(increments counter variable, () { const component render(Counter /); const button component.getByRole(button); fireEvent.click(button); expect(component.state.counter).toBe(1); // Testing internal state }); // ✅ Good test: Behavior testing test(displays incremented count when clicked, () { render(Counter /); const button screen.getByRole(button, { name: /increment/i }); fireEvent.click(button); expect(screen.getByText(Count: 1)).toBeInTheDocument(); });评审测试时的五个问题测试描述的是行为还是实现测试命名是否清晰是否覆盖边界情况测试是否相互独立无共享状态测试能否以任意顺序运行模式 3安全评审Security Review认证与授权需要认证的地方是否都有认证每个操作前是否都做了授权检查JWT 校验是否完整签名、过期时间API Key/密钥是否妥善保管输入校验所有用户输入是否都经过校验文件上传是否受限大小、类型SQL 是否参数化是否做了 XSS 转义输出数据保护密码是否哈希bcrypt/argon2敏感数据是否静态加密敏感数据是否强制 HTTPSPII 是否合规处理常见漏洞是否存在 eval() 或类似动态执行是否有硬编码密钥状态变更操作是否有 CSRF 防护公共端点是否限流给出困难反馈的沟通模式改进版三明治法The Sandwich Method, Modified传统表扬 批评 表扬容易显得虚伪技能推荐上下文 具体问题 解决方案I noticed the payment processing logic is inline in the controller. This makes it harder to test and reuse. [Specific Issue] The calculateTotal() function mixes tax calculation, discount logic, and database queries, making it difficult to unit test and reason about. [Helpful Solution] Could we extract this into a PaymentService class? That would make it testable and reusable. I can pair with you on this if helpful.处理分歧当作者不同意你的反馈时按以下顺序推进先求理解Help me understand your approach. What led you to choose this pattern?承认合理之处Thats a good point about X. I hadnt considered that.用数据说话Im concerned about performance. Can we add a benchmark to validate the approach?必要时升级Lets get [architect/senior dev] to weigh in on this.知道何时放手如果改动已经可用且不是关键问题就批准它。完美是进步的敌人。这一协作式分歧处理理念同样体现在 pr-enhance 命令 内置的 review response 模板中——disagree_respectfully、explain_decision、request_clarification等模板正是把上述沟通策略沉淀成了可复用的文案。最佳实践与常见陷阱八条最佳实践及时评审24 小时内完成理想情况是当天控制 PR 规模200–400 行为有效评审上限分时间块评审单次不超过 60 分钟注意休息善用评审工具GitHub、GitLab 或专用工具尽可能自动化linter、formatter、安全扫描建立融洽关系emoji、表扬与同理心都很重要保持可用对复杂问题主动提出结对向他人学习复盘他人的评审评论七个常见陷阱完美主义Perfectionism为无关紧要的风格偏好阻塞 PR范围蔓延Scope Creep顺便把 X 也改了吧标准不一致Inconsistency对不同的人用不同标准评审拖延Delayed Reviews让 PR 躺上好几天玩消失Ghosting要求改完后又消失不见橡皮图章Rubber Stamping没有真正评审就批准自行车棚效应Bike Shedding在琐碎细节上争论不休模板PR 评审评论模板## Summary [Brief overview of what was reviewed] ## Strengths - [What was done well] - [Good patterns or approaches] ## Required Changes [Blocking issue 1] [Blocking issue 2] ## Suggestions [Improvement 1] [Improvement 2] ## Questions ❓ [Clarification needed on X] ❓ [Alternative approach consideration] ## Verdict ✅ Approve after addressing required changes【免费下载链接】agentsMulti-harness agentic plugin marketplace for Claude Code, Codex, Cursor, OpenCode, GitHub Copilot, and Google Antigravity项目地址: https://gitcode.com/GitHub_Trending/agents24/agents创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考