msw
ec3aca7fc8
🛡️ Retrieve DNSSEC status of coresecret.dev. / 🛡️ Retrieve DNSSEC status of coresecret.dev. (push) Has been cancelled
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Has been cancelled
💙 Generating a PUBLIC Live ISO. / 💙 Generating a PUBLIC Live ISO. (push) Has been cancelled
🔐 Generating a Private Live ISO TRIXIE. / 🔐 Generating a Private Live ISO TRIXIE. (push) Has been cancelled
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
2.3 KiB
2.3 KiB
code_review.md
Use this file for explicit review tasks and final self-review after implementation. Do not treat it as a mandate for an unlimited audit unless the user asks for one.
Review priorities
Review findings in this order:
- Correctness
- Security regressions
- Boot/build reproducibility
- Data loss risk
- Error handling
- Test or validation coverage
- Maintainability
- Minimality of diff
- Style consistency
Finding classes
BLOCKER: proven correctness bug, security regression, build break, boot break, or data loss risk that must be fixed before merge.RISK: plausible issue or security concern that is not fully proven from the available context.CLEANUP: maintainability, readability, or consistency improvement that is not required for correctness.NOTE: observation only; no change requested.
Review output format
List findings first, ordered by severity.
For each finding include:
- class
- file path and line number where possible
- observation
- concrete impact
- smallest reasonable fix
Then include:
- missing checks or validation gaps
- residual risks
- concise final recommendation
If there are no findings, say so explicitly and still mention relevant validation gaps.
Scope control
- Do not nitpick formatting when automated tooling exists.
- Do not invent requirements not present in the task, repository, or documentation.
- Do not expand a small implementation task into a broad quality-management audit.
- Do not request a full live build unless the changed code path affects image generation in a way that cannot be checked narrowly.
- Prefer a small actionable finding over a broad speculative warning.
Security-sensitive checklist
Check whether the change affects:
- boot trust
- initramfs behavior
- live-boot runtime behavior
- cryptsetup/LUKS handling
- encrypted SquashFS handling
- key material
- remote unlock
- TLS or mTLS verification
- signature, checksum, or provenance verification
- package sources or remote downloads
- network exposure
- file permissions
- persistence
- logging of sensitive values
For affected areas, separate observation, inference, and recommendation.
no tracking | no logging | no advertising | no profiling | no bullshit