Code review agents
Each agent is a review rule for one kind of bug, shown with code it flags. Turn it on in cubic to check every pull request, or paste it into AGENTS.md so your AI coding tool follows it too.
Security
- Next.js
Authorize and Validate Every Next.js Server Action
Flags Next.js Server Actions that skip session checks, trust client-supplied record IDs, or write unvalidated input to the database.
- Node.js
Prevent Command Injection and Path Traversal in Node.js
Catches child_process exec calls built from untrusted input, and path.join or path.resolve on user input with no base-directory containment check.
- Python
Block Unsafe Deserialization and Shell Injection in Python
Flags pickle, marshal, and unsafe YAML loaders on untrusted data, shell=True commands built from input, option injection, and eval or exec on user input.
- Django
Scope Django Querysets to the Current User or Tenant
Flags Django views and DRF viewsets that load objects by ID without filtering on the requesting user or tenant, the root cause of IDOR bugs.
- Django
Prevent SQL Injection in Django Raw Queries
Flags Django raw(), extra(), RawSQL, and cursor.execute() calls that build SQL with f-strings, % formatting, or .format() instead of params.
- Ruby on Rails
Block Mass Assignment and Unscoped Finds in Rails
Catches params.permit!, permitted role or ownership attributes, and Model.find(params[:id]) lookups that skip current_user or tenant scoping.
- Spring Boot
Require Authorization on Every Spring Boot Endpoint
Flags Spring Boot endpoints with no authorization rule, broad permitAll() matchers, ignored method security, and lookups by ID without ownership checks.
- Any stack
Flag Security Vulnerabilities
Catches hardcoded secrets, SQL injection, XSS, weak crypto, unsafe deserialization, and plain-HTTP calls in pull requests before they ship.
Security & privacy
- Next.js
Keep Secrets and Server-Only Code Out of Next.js Client Bundles
Catches secrets behind NEXT_PUBLIC_, server modules imported into Client Components, and full database records or tokens passed to the browser.
- Next.js
Keep Per-User Data Out of Shared Caches in Next.js
Finds per-user data kept in module state, under cache keys that omit the user, or in public CDN responses, plus mutations that skip revalidation.
- Any stack
Prevent Sensitive Data in Logs
Flags logs, error reports, and analytics events that expose passwords, tokens, emails, card data, or raw request bodies without redaction.
API safety
- Spring Boot
Validate Request DTOs and Stop Exposing Entities in Spring Boot
Flags @RequestBody parameters missing @Valid, JPA entities returned from controllers, and requests bound onto entities so clients can set any field.
- Any stack
Require API Auth, Validation, and Tenant Scoping
Flags API endpoints that skip auth, trust client-supplied tenant or account IDs, accept unvalidated request bodies, or leak internal errors.
Database
- Django
Enforce Zero-Downtime Migrations in Django
Flags Django migrations that lock or rewrite large PostgreSQL tables, or break the release that is still serving traffic during a deploy.
- Ruby on Rails
Enforce Zero-Downtime Migrations in Rails
Flags Rails migrations that lock PostgreSQL tables or break running servers: blocking indexes, unsafe column drops, table rewrites, inline backfills.
- PostgreSQL
Create PostgreSQL Indexes Concurrently on Live Tables
Flags PostgreSQL index builds and drops that lock live tables: CREATE INDEX without CONCURRENTLY, concurrent builds in transactions, INVALID leftovers.
- PostgreSQL
Set lock_timeout Before Blocking DDL in PostgreSQL
Flags PostgreSQL ALTER TABLE and other blocking DDL run without lock_timeout, which can stall every query on the table while it waits for its lock.
- PostgreSQL
Add PostgreSQL Constraints Without Long Table Locks
Flags PostgreSQL constraints added without NOT VALID, SET NOT NULL that scans the table, and column type changes that rewrite it under a blocking lock.
- PostgreSQL
Batch Large Backfills and Deletes in PostgreSQL
Flags single UPDATE or DELETE statements over millions of PostgreSQL rows in migrations and deploy steps, and batch loops that never commit.
- Any stack
Block Unsafe Database Migrations
Catches migrations that lock or rewrite large tables, build blocking indexes, or run full-table backfills, and suggests phased rollouts.
- Any stack
Enforce Rollback Steps in Database Migrations
Requires every database migration to include a down or rollback step, so a bad deploy can be reversed without writing SQL by hand under pressure.
- Any stack
Prevent Database Query Performance Regressions
Catches N+1 queries, unbounded list endpoints, missing pagination, per-row writes in loops, and over-fetching before they slow down production.
Performance
- React
Prevent Unnecessary Re-renders from Unstable Values in React
Flags React context values, memo props, and effect dependencies recreated on every render, which re-render large trees or rerun effects.
- Next.js
Avoid Request Waterfalls in Next.js Server Components
Flags Next.js Server Components, pages, and layouts that await independent requests one at a time instead of starting them in parallel.
- Next.js
Stream Slow Data in Next.js Instead of Blocking the Route
Flags slow awaits that hold back an entire Next.js layout or page, and Suspense boundaries placed where they cannot stream anything.
- Node.js
Prevent Event Loop Blocking in Node.js
Flags synchronous fs, crypto, zlib, and child_process calls, unbounded CPU work, and ReDoS-prone regexes that stall every request in a Node.js server.
- Node.js
Stream Large Payloads Instead of Buffering in Node.js
Flags Node.js code that reads whole files or HTTP bodies into memory, raises body size limits, or pipes streams without pipeline() error handling.
- Python
Prevent Blocking Calls in Async Python Code
Finds time.sleep, requests, sync database drivers, and heavy CPU work inside async def functions, where one slow call stalls every task on the event loop.
- Django
Prevent N+1 Queries in Django
Flags Django ORM relations read per row in loops, DRF serializers, and templates without select_related, prefetch_related, or annotate.
- Ruby on Rails
Prevent N+1 Queries in Rails
Flags Active Record associations read in loops, views, and serializers without includes or preload, and per-row count queries.
- Ruby on Rails
Use Batch Processing for Large Tables in Rails
Flags .each over unbounded relations, map(&:id) instead of pluck, aggregates computed in Ruby, and unpaginated queries in Rails request paths.
- Spring Boot
Prevent JPA N+1 Queries and Lazy Loading Traps in Spring Boot
Flags lazy JPA associations loaded once per row in loops and serializers, reliance on open-in-view, and EAGER mappings that cause N+1 queries.
- PostgreSQL
Index Foreign Keys and New Query Filters in PostgreSQL
Flags PostgreSQL foreign keys without an index on the referencing columns, and new queries that filter or sort large tables on unindexed columns.
Reliability
- React
Require Effect Cleanup and Race-Safe Data Fetching in React
Flags React effects that leave listeners, timers, or sockets running after unmount, and fetches that let a stale response overwrite a newer one.
- TypeScript
Validate External Data at Runtime in TypeScript
Flags JSON.parse results, fetch responses, env vars, storage, and postMessage data that TypeScript trusts through a cast or generic instead of a schema.
- TypeScript
Prevent Swallowed Errors and Empty Catch Blocks in TypeScript
Flags empty catch blocks, catch-all fallbacks that return null, rethrows without a cause, and non-Error throws that hide failures in TypeScript code.
- Node.js
Handle Async Errors and Unhandled Rejections in Node.js
Catches floating promises, async EventEmitter listeners, and Express 4 async handlers whose rejections crash the process or never reach an error handler.
- Node.js
Require Timeouts and Bounded Retries on Node.js HTTP Calls
Flags fetch, axios, and http.request calls with no timeout, and retry loops without a cap, backoff, or idempotency key in Node.js services.
- Python
Prevent Resource Leaks with Context Managers in Python
Flags files, sockets, database connections, locks, and temp files left open when code raises, including sqlite3 connections a with block does not close.
- Python
Require Timeouts on Python Network Calls
Catches requests calls without a timeout, disabled httpx timeouts, and boto3, Redis, and database clients left on long or unbounded defaults.
- Django
Make Django Writes Atomic and Run Side Effects on Commit
Flags related Django writes outside transaction.atomic and Celery tasks, emails, or webhooks sent before the transaction commits.
- Ruby on Rails
Run Side Effects After Commit in Rails Callbacks
Catches emails, jobs, and API calls fired from after_save or inside transactions that can roll back, and dirty checks that stop working after save.
- Go
Prevent Goroutine Leaks in Go
Catches goroutines that never exit: sends nobody receives, loops with no cancellation path, channels never closed, and tickers that keep running.
- Go
Propagate context.Context Through Go Request Paths
Catches Go code that drops context.Context: Background() in request paths, calls without QueryContext or NewRequestWithContext, and missing deadlines.
- Go
Close Resources and Check Deferred Close Errors in Go
Catches unclosed response bodies and sql.Rows, missing rows.Err checks, defer inside loops, and ignored Close errors on files opened for writing.
Correctness
- React
Remove Unnecessary useEffect and Derived State in React
Flags useEffect calls that copy props into state, compute values for rendering, or chain state updates that belong in render or an event handler.
- React
Use Stable Keys Instead of Array Index in React Lists
Flags array index, random, and non-unique keys on React lists that reorder or change, which attach state, input values, and focus to the wrong row.
- TypeScript
Prevent Unsafe Casts and Non-Null Assertions in TypeScript
Catches type assertions, double casts through unknown, non-null assertions, and silenced type errors that hide real bugs in TypeScript.
- TypeScript
Require Exhaustive Union Handling in TypeScript
Flags switches and if chains over TypeScript unions that lack a never check, so a newly added variant compiles and is silently ignored or mishandled.
- Python
Prevent Swallowed Exceptions in Python
Flags except-and-pass handlers, broad catches that return a default the caller mistakes for success, and new exceptions raised without the original cause.
- Go
Handle and Wrap Every Error with Context in Go
Flags Go errors that are discarded, logged and dropped, shadowed, or wrapped with %v, so failures surface with context and errors.Is keeps working.
- Go
Prevent Data Races on Shared State in Go
Catches maps, counters, and slices shared across goroutines without a mutex or atomic, plus mutex-guarded state that escapes its lock.
- Spring Boot
Catch @Transactional Pitfalls in Spring Boot
Catches @Transactional calls that bypass the Spring proxy, checked exceptions that commit instead of rolling back, and remote calls inside transactions.
Testing
Code quality
- TypeScript
Model State with Discriminated Unions in TypeScript
Flags TypeScript state built from booleans and optional fields, like isLoading plus data?, that allows impossible states a discriminated union rules out.
- Any stack
Flag AI Slop and Fabricated Changes
Catches AI slop: placeholder data, fake implementations, docs claiming unbuilt behavior, references to missing files or env vars, and narrating comments.
- Any stack
Enforce Strict Maintainability Standards
Flags one-off booleans and special cases in shared code, pass-through wrappers, copy-pasted logic, silent fallbacks, and files pushed past 1,000 lines.
Frontend
- React
Handle Loading, Empty, and Error States in React
Flags React views that render only the success case, leaving blank screens during loading, silent failures on errors, and no message for empty data.
- Any stack
Enforce React and Next.js Production Guardrails
Flags needless "use client" pages, auth enforced only in middleware, direct DOM access, and hydration-prone renders in React and Next.js code.
Accessibility
Configuration
- Spring Boot
Lock Down Spring Boot Actuator, Secrets, and CORS
Flags exposed Actuator endpoints such as heapdump and env, secrets committed to application.yml, and CORS rules that allow any origin with credentials.
- Any stack
Detect Duplicate or Outdated Feature Flag Usage
Flags deprecated or fully launched feature flags in new code, raw flag keys outside the central registry, and repeated checks of the same flag.