Prompts

Ultrareview

Revisão de bugs
CGCalney G.

Please perform an ultra-comprehensive code review of the code in this repository.

This review must go beyond a standard review and cover ALL of the following dimensions:

  1. Security (OWASP Top 10 + extras)
  • Injection vulnerabiiities (SQL，command，LDAP，XSS，SSTI，CRLF)
  • Broken authentication/ session management
  • XML/JSoN ExternalEntity(XXE）processing
  • Sensitive data exposure (secrets, PII, tokens in logs or source)
  • Broken access control and'priviiege escaiation paths
  • Cross-site scripting (Stored, Reflected,'DoM-based)
  • Security misconfiguration (default creds, open ports, verbose errors)
  • Insecure deserialization
  • Insufficient logging and monitoring
  • Using components with known vulnerabilities (outdated deps)
  • Path traversal and file inclusion
  • Race conditions, ToCToU, deadlocks
  • Cryptographic weaknesses (weak algorithms,key reuse， bad IV)
  • Supply chain/ dependency confusion risks
  1. Performance
  • Algorithmic complexity: 0(n²) or worse in hot paths
  • Unnecessary allocations, copies, or clones
  • Database N+1 query patterns
  • Missing indexes on frequently queried fields
  • Blocking I/0 in async contexts
  • Unbounded loops orrecursion
  • Memory leaks or resource leaks (file handles, sockets)
  • Caching opportunities
  1. Maintainability & Code Quality
  • Functions / methods exceeding 50 lines
  • Deep nesting (>4 levels)
  • Duplicated iogic (DRY violations)
  • Magic numbers and strings without named constants
  • Misleading names (variables，functions，types)
  • Dead code and unused imports
  • Overly complex conditionals
  • Coupling:tight coupling between unrelated modules
  1. Error Handling
  • Swallowed errors(empty catch blocks,unwrap() without context)
  • Panic-able paths in library code
  • Missing input validation at trust boundaries
  • Unclear error messages that hinder debugging
  • Error type inconsistency across the codebase
  1. Test Coverage
  • Missing unit tests for critical logic
  • Missing integration tests for external boundaries
  • Tests with no assertions
  • Tests that are brittle (time-dependent, order-dependent)
  • Missing negative/ edge-case tests
  • Mocking strategy concerns

6.API Design

  • Unclear or inconsistent naming conventions
  • Functions with too many parameters (>5)
  • Mutable global state
  • Missing or incorrect use of visibility modifiers
  • Breaking changes risk in public interfaces
  • Lack of~builder or fluent patterns where appropriate
  1. Documentation
  • Missing doc comments on public items
  • Outdated or misleading comments
  • Undocumented panics,unsafe blocks, or invariants
  • Missing README or high-level architectural overview
  1. Architectural Concerns
  • Single Responsibility Principle violations
  • Circular dependencies
  • Missing abstraction layers
  • Hardcoded configuration that should be externalised
  • Observability gaps (missing tracing， metrics， structured logs)

Output Format For every finding, provide:

  • Category (from the dimensions above)
  • Severity:Critical/ High/ Medium/ Low / Informational
  • File and line number (if applicable)
  • Description of the issue
  • Impact:what can go wrong
  • Recommended fix with a code snippet where helpful

Start by reading the main source files, dependency manifests, and any CI/CD configuration. Group findings by severity (Critical first). Conciude with a' prioritised action plan.