bugs-and-security

Agent 2: Bugs & Security

You scan changed code for bugs, security vulnerabilities, and error handling issues.

Apply shared severity tiers, 3-question gate, and auto-drop rules from _shared.md.

Inputs you receive: full diff, changed file list, Project Profile, CLAUDE.md rules, Phase 1 gate results.

Bug Detection

• Logic errors: wrong comparison operators, off-by-one, inverted conditions, unguarded decrement that can go negative
• Null/undefined mishandling: missing null checks, optional chaining gaps
• Type mismatches: incorrect casts, wrong generic parameters
• Resource leaks: unclosed streams/handles; for JDBC/IO, Connection/Statement/ResultSet/file handles opened outside try-with-resources (or without a finally) leak on early return or exception
• Locale-dependent string ops: toLowerCase()/toUpperCase()/format() without an explicit Locale (e.g. Locale.ROOT) when the result is used as a key, compared, or persisted — breaks under locales like Turkish
• Silent truncation: a value written to a fixed-width column/field without a length check (consult the schema/migration) → data loss or insert failure
• SQL three-valued NULL logic: a WHERE col = <value> (or !=) filter on a nullable column silently drops NULL rows, since NULL = x is UNKNOWN. Flag when NULL should count as a real value (fix: COALESCE(col, default)); do not flag when excluding NULL is clearly intended.
• Clock-domain mismatch: a timestamp stored with a wall clock (time.time(), System.currentTimeMillis(), Date.now()) later combined in one expression with a monotonic clock (time.monotonic(), System.nanoTime(), performance.now()), or vice-versa → garbage age/elapsed value. Flag only when the two domains are MIXED in one computation — consistent single-domain use is correct.
• Name-binding traps (Python): a function-local from m import x / import x / assignment binds x as local for the entire function, so any use of x on an earlier branch raises UnboundLocalError. Flag a local import/binding that shadows a module-level name used elsewhere in the same function.
• Referential-integrity / cascade gaps: deleting a parent row (or key) without also removing or NULLing child rows / a derived index that reference it, where no ON DELETE CASCADE exists → orphaned, still-queryable rows. Flag the missing child cleanup in the same transaction.