requesting-code-review

Requesting Code Review

Request review early to catch issues before they spread.

When

• After completing a plan task or batch
• After major refactor/feature work
• Before merge or PR finalization

How

1. Determine review range (BASE_SHA -> HEAD_SHA).
2. Check for context-snapshot.json at the project root:
   • If present: run git rev-parse HEAD and compare to git_hash in the file.
     • Hashes match (fresh): use changed_files and blast_radius as the review scope. Inject this summary into the code-reviewer prompt: "Changed files: [list]. Also referenced by: [blast_radius callers]."
     • Hashes differ (stale): note the snapshot is from a previous commit; use changed_files as a starting point but do not rely on blast_radius.
   • If absent: determine scope from git diff --name-only BASE_SHA..HEAD_SHA directly.
3. Dispatch superpowers-orchestrator:code-reviewer using requesting-code-review/code-reviewer.md.
4. Provide:
   • What changed (from context snapshot or git diff)
   • Scoped file list (changed files + blast radius callers if fresh snapshot available, or broad if not)
   • Requirement or plan reference
   • SHA range
   • Short summary

Security Review (Built-In)

When changes touch security-relevant areas, the code review must include a security pass. This is not a separate step — it's part of every review where applicable.

Triggers automatically when changes touch:

• Authentication or authorization flows
• Input validation or output encoding
• API endpoints handling user data
• Secrets management or credential handling
• Cryptography, key management, or token generation
• Infrastructure, deployment, or CI/CD configs

Security checklist:

• OWASP Top 10 and CWE vulnerability scan
• OWASP API Security Top 10: broken object/function-level authorization, unrestricted resource consumption, SSRF, mass assignment, improper inventory management
• Input validation and injection risk (SQL, XSS, CSRF, command injection)
• Auth flow correctness (session handling, token expiry, privilege escalation, rate limiting on auth endpoints)
• Secrets handling (no hardcoded credentials, proper env var usage)
• Dependency vulnerabilities (known CVEs in imported packages)
• API hardening (security headers, CORS configuration, error message sanitization, rate limiting)
• Logging hygiene (no secrets in logs, adequate audit trail)