▸case-01 I just pushed a bunch of commits for our new subscription management feature. Can you review the recent git diff and give me a full breakdown? I'd like a brief overview of what changed, a categorized list of modified files by domain, a thorough security audit regarding auth and inputs, key risk areas, potential edge cases, any incomplete wiring, and any questions or assumptions you need me to clarify. | fail→fail | 13,151 | 11,642 | -11% | 1 | 1 | 0% | 1,455 | 959 | -34% | 0 | 0 | — |
▸case-02 Here is a git patch where we added Stripe webhook handlers in `src/api/webhooks/stripe.ts` and updated `src/db/orders.ts` to update order status upon receiving `payment_intent.succeeded`. A junior dev wrote this without signature validation or secret checking. Give me a code change analysis highlighting security risks, file areas, and risks. | fail→pass | 18,127 | 22,571 | +25% | 1 | 1 | 0% | 1,498 | 2,722 | +82% | 0 | 0 | — |
▸case-03 We replaced JWT cookie verification in `middleware/auth.ts` with a header-based Bearer token check, and modified `controllers/user.ts` to pull user IDs directly from decoded headers without validating token expiration. Analyze these code changes. | pass→pass | 14,852 | 11,722 | -21% | 1 | 1 | 0% | 2,654 | 2,157 | -19% | 0 | 0 | — |
▸case-04 We added profile picture updates: `POST /api/user/avatar` handles multipart uploads in `routes/user.js`, writing directly to S3 via `utils/s3.js` and updating `users` table via `db/queries.js`. The payload accepts raw file streams without checking MIME types or file size limits. Analyze these changes. | pass→pass | 19,894 | 11,079 | -44% | 1 | 1 | 0% | 3,232 | 2,109 | -35% | 0 | 0 | — |
▸case-05 Our diff changes `db/reports.ts` from static parameterized queries to string-concatenated raw SQL queries built from dynamic URL query parameter strings in `api/analytics.ts`. Review this commit. | fail→pass | 14,123 | 10,678 | -24% | 1 | 1 | 0% | 2,360 | 1,972 | -16% | 0 | 0 | — |
▸case-06 We added a background worker in `jobs/crmSync.ts` that fetches changed leads from Postgres (`db/leads.ts`) and POSTs them to Salesforce REST API using hardcoded API credentials stored in `constants/config.ts`. Analyze this diff. | pass→pass | 15,247 | 20,052 | +32% | 1 | 1 | 0% | 2,472 | 2,033 | -18% | 0 | 0 | — |
▸case-07 In `routes/auth.js` and `services/email.js`, we introduced password reset request functionality. The endpoint generates a token using `Math.random()`, saves it to `db/tokens.js`, and sends a reset link. Review the code changes. | fail→pass | 23,525 | 11,082 | -53% | 1 | 1 | 0% | 2,295 | 2,171 | -5% | 0 | 0 | — |
▸case-08 We modified `graphql/schema.graphql` and `graphql/resolvers/account.ts` to add a new `deleteAccount` mutation that executes `DELETE FROM accounts WHERE id = args.id` without checking if `context.currentUser.id` matches `args.id`. Analyze this commit. | pass→pass | 15,709 | 8,853 | -44% | 1 | 1 | 0% | 2,767 | 1,741 | -37% | 0 | 0 | — |
▸case-09 Added an admin feature in `controllers/admin.ts` allowing admins to issue session tokens for any user ID via `POST /api/admin/impersonate`. The endpoint checks `user.isAdmin` from the request body JSON payload rather than session state. Review these changes. | fail→pass | 16,299 | 15,436 | -5% | 1 | 1 | 0% | 1,697 | 2,278 | +34% | 0 | 0 | — |
▸case-10 We added `GET /api/export/csv` in `routes/export.js` that streams user data retrieved via `services/exporter.js`. The response headers set `Content-Type: text/csv`, but user inputs are appended directly into CSV cells without escaping formula characters (`=`, `@`, `+`). Review this patch. | pass→pass | 17,524 | 10,927 | -38% | 1 | 1 | 0% | 3,150 | 2,327 | -26% | 0 | 0 | — |
▸case-11 In `lib/cache.ts` and `api/products.ts`, we introduced Redis caching for product listings. When cache miss occurs, data is fetched from DB and written to Redis with no expiration time set. Review the pull request. | pass→pass | 16,114 | 10,812 | -33% | 1 | 1 | 0% | 2,369 | 2,087 | -12% | 0 | 0 | — |
▸case-12 We altered `middleware/tenant.ts` and `db/schema.prisma` to add `orgId` filtering to database queries. However, `db/schema.prisma` updates were omitted from the git commit diff while `middleware/tenant.ts` references the new field. Analyze these changes. | pass→pass | 13,499 | 10,266 | -24% | 1 | 1 | 0% | 2,269 | 2,043 | -10% | 0 | 0 | — |
▸case-13 Modified `routes/settings.ts` and `models/user.ts` to allow users to update email notification flags. The endpoint parses JSON directly into `User.update()` without filtering allowed keys, allowing arbitrary column updates. Review the diff. | pass→pass | 13,186 | 9,591 | -27% | 1 | 1 | 0% | 2,018 | 1,606 | -20% | 0 | 0 | — |
▸case-14 Added `utils/cleanup.ts` which runs `fs.rmSync(path.join('/tmp/uploads', req.body.filename))` inside an HTTP request handler in `api/cleanup.ts`. Review this commit. | pass→pass | 14,053 | 12,785 | -9% | 1 | 1 | 0% | 2,611 | 2,123 | -19% | 0 | 0 | — |
▸case-15 Added elasticsearch indexing in `services/search.ts` and a frontend auto-complete component in `components/SearchBox.tsx`. The component calls `GET /api/search?q=` on every keystroke without debouncing or escaping special regex tokens. Analyze these changes. | fail→pass | 19,453 | 14,778 | -24% | 1 | 1 | 0% | 3,371 | 2,592 | -23% | 0 | 0 | — |
▸case-16 Implemented SAML 2.0 auth in `routes/sso.js` and `utils/saml.js`. XML signatures from incoming assertions are parsed using `fast-xml-parser` without disabling external entity resolution (XXE). Review this code change. | fail→fail | 18,526 | 13,264 | -28% | 1 | 1 | 0% | 3,301 | 2,466 | -25% | 0 | 0 | — |
▸case-17 We added LaunchDarkly feature flag evaluations in `controllers/dashboard.ts` and `views/Dashboard.tsx`. If the feature flag service times out, the code throws an unhandled exception halting request processing. Review this patch. | pass→pass | 20,590 | 11,207 | -46% | 1 | 1 | 0% | 2,833 | 2,036 | -28% | 0 | 0 | — |
▸case-18 Added coupon code logic in `services/checkout.ts` and `models/coupon.ts`. When applying a coupon, `discountAmount` is subtracted from `totalPrice` without verifying if `totalPrice` falls below zero. Review these changes. | fail→pass | 15,659 | 11,713 | -25% | 1 | 1 | 0% | 2,348 | 2,101 | -11% | 0 | 0 | — |
▸case-19 Added global request logger in `middleware/auditLogger.ts` that intercepts all HTTP requests and inserts `req.body` into `audit_logs` table in MongoDB. The request body includes plain text passwords from `/api/login`. Review these modifications. | pass→pass | 20,118 | 22,750 | +13% | 1 | 1 | 0% | 2,272 | 2,300 | +1% | 0 | 0 | — |
▸case-20 I made edits across `src/auth.ts`, `src/db.ts`, and `package.json` to update dependencies and fix a token expiration bug. Write a clean git commit message following conventional commit standards for this change. | pass→fail | 6,951 | 20,270 | +192% | 1 | 1 | 0% | 1,164 | 1,920 | +65% | 0 | 0 | — |
▸case-21 Draft a Markdown template file `.github/PULL_REQUEST_TEMPLATE.md` that our open-source project contributors can fill out when submitting bug fixes or features. | pass→pass | 10,786 | 7,503 | -30% | 1 | 1 | 0% | 1,797 | 1,399 | -22% | 0 | 0 | — |
▸case-22 Our monolithic legacy Node.js application suffers from tight coupling between business logic and SQL database queries. Propose an architectural refactoring plan to introduce a repository pattern over the next month. | pass→pass | 20,426 | 15,534 | -24% | 1 | 1 | 0% | 3,530 | 2,677 | -24% | 0 | 0 | — |