audit-code

Audit Code

HARD GATE — HARD GATE — Audit must check for: bugs (correctness), security, performance, and clarity. Do NOT skip security review if the code touches user data, auth, or external APIs.

Run this self-review before asking anyone else to look at the code. The goal is to catch everything that is clearly wrong or missing — so the reviewer can focus on design and architecture, not hygiene.

Distinct from request-review: This is the coding agent checking its own work. No second agent is involved. Run this first; run request-review after this passes.

Look-here-first (churn heuristic)

Before the checklist, rank changed files by git churn and review high-churn hotspots first — they carry the most latent risk regardless of diff size.

bash scripts/bp-churn-rank.sh --since 90.days --limit 15

Apply the full checklist to churn-ranked files in descending order. Files with zero recent commits but large diffs still get reviewed; churn only sets priority, not scope.

Modes

• Default: full checklist
• --quick: Run only Supply Chain and Test Coverage. Use for changes under 50 LOC.
• --gate: Non-interactive mode for automated CI gating (used by build-epic step 6). Exit with non-zero status code (exit 1) on ANY checklist failure; exit 0 only if ALL items pass. Produces a compact pass/fail summary to stderr. On failure, list every ✗ item with reason.
• --parallel: Run checklist sections in isolated git worktrees (e45s18) so concurrent checks cannot corrupt each other's working tree:

bash scripts/lib/parallel-review-worktrees.sh audit-code

Checklist

Supply Chain & Security

• slopcheck run for new dependencies; packages tagged in plan-work: [OK], [SUS], or [SLOP]
• No [SLOP] packages without documented human approval
• No secrets in diff (sk-, ghp_, AKIA, .env values) — see guard-git patterns
• OWASP Top 10 spot-check: injection, broken auth, sensitive data exposure, misconfiguration (see docs/references/security-threats.md)
• Security: diff scanned — no unaddressed HIGH findings (or deviations documented in specs/security/EXCEPTIONS.md)