Review Card
The eight rooms on one page, for the desk beside your editor
One page, built from the eight rooms. Print it and keep it beside the screen.
01Ask for work you can check
- Trade every adjective ("secure", "clean", "robust") for something a test can prove.
- Name the files it may touch and the things that must not change.
- Ask for the plan first; strike anything you did not ask for.
02Read the whole diff
- Read the removed lines as carefully as the added ones.
- Hunt for debug logging, always-true stubs and TODOs where a check should be.
- Stage with
git add -pso every hunk is looked at once.
03Keep secrets out of the code
- No key, token or password in code, not even as a fallback value.
- A committed secret is exposed: rotate it, then clean history.
- Logs and error messages never include tokens, headers or request bodies.
04Treat every input as hostile
- Queries use parameters; input never becomes SQL text.
- Every value written into a page is encoded for where it lands.
- File paths and redirect targets never come straight from the request.
05Check who is asking
- Every route checks that THIS user may touch THIS record, on the server.
- A hidden button is not a permission check.
- Never copy a whole request body onto a record; list the fields allowed.
06Check that it exists
- Every new package: look it up on its index first (publisher, age, repository).
- Watch for names one typo away from a famous package.
- Run each new call once; check unfamiliar methods in the library's docs.
07Make tests able to fail
- Assert exact values, not "is defined".
- Expected errors are asserted (toThrow, pytest.raises), never swallowed.
- Break the code on purpose once: the tests must go red.
08Plan for when it breaks
- Every network call has a timeout.
- Retries are capped, with growing waits.
- No empty catch blocks; never answer "success" after a failure.
Diffhall is a self-study website, not a school; this card is a checklist, not a certificate. Powered by WeldonPC.com.