Code review standards
Review rules for the bugs that get past tests and linters, grouped by language and framework. Turn them on in cubic to check every pull request, or paste them into AGENTS.md so your AI coding tool follows them too.
Languages and frameworks
- React12 agents
- Remove Unnecessary useEffect and Derived State in React
- Use Stable Keys Instead of Array Index in React Lists
- Require Effect Cleanup and Race-Safe Data Fetching in React
- Next.js12 agents
- Authorize and Validate Every Next.js Server Action
- Keep Secrets and Server-Only Code Out of Next.js Client Bundles
- Keep Per-User Data Out of Shared Caches in Next.js
- TypeScript11 agents
- Prevent Unsafe Casts and Non-Null Assertions in TypeScript
- Validate External Data at Runtime in TypeScript
- Require Exhaustive Union Handling in TypeScript
- Node.js12 agents
- Prevent Event Loop Blocking in Node.js
- Handle Async Errors and Unhandled Rejections in Node.js
- Require Timeouts and Bounded Retries on Node.js HTTP Calls
- Python12 agents
- Prevent Swallowed Exceptions in Python
- Prevent Resource Leaks with Context Managers in Python
- Require Timeouts on Python Network Calls
- Django12 agents
- Prevent N+1 Queries in Django
- Scope Django Querysets to the Current User or Tenant
- Enforce Zero-Downtime Migrations in Django
- Ruby on Rails12 agents
- Prevent N+1 Queries in Rails
- Block Mass Assignment and Unscoped Finds in Rails
- Enforce Zero-Downtime Migrations in Rails
- Go11 agents
- Handle and Wrap Every Error with Context in Go
- Prevent Goroutine Leaks in Go
- Propagate context.Context Through Go Request Paths
- Spring Boot12 agents
- Catch @Transactional Pitfalls in Spring Boot
- Prevent JPA N+1 Queries and Lazy Loading Traps in Spring Boot
- Validate Request DTOs and Stop Exposing Entities in Spring Boot
- PostgreSQL11 agents
- Create PostgreSQL Indexes Concurrently on Live Tables
- Set lock_timeout Before Blocking DDL in PostgreSQL
- Add PostgreSQL Constraints Without Long Table Locks
For any codebase
Agents that apply to any language or framework.
- Security
Flag Security Vulnerabilities
- Security & privacy
Prevent Sensitive Data in Logs
- Database
Block Unsafe Database Migrations
- Database
Enforce Rollback Steps in Database Migrations
- Database
Prevent Database Query Performance Regressions
- API safety
Require API Auth, Validation, and Tenant Scoping
- Testing
Enforce Pragmatic Test Coverage
- Code quality
Flag AI Slop and Fabricated Changes
- Code quality
Enforce Strict Maintainability Standards
- Accessibility
Enforce Accessibility Standards (WCAG 2.1 AA)
- Frontend
Enforce React and Next.js Production Guardrails
- Configuration
Detect Duplicate or Outdated Feature Flag Usage
- Localization
Enforce i18n for User-Facing Strings