Find Bugs

1---
2name: find-bugs
3description: Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
4---
5 
6# Find Bugs
7 
8Review changes on this branch for bugs, security vulnerabilities, and code quality issues.
9 
10## Phase 1: Complete Input Gathering
11 
121. Get the FULL diff: `git diff $(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name')...HEAD`
132. If output is truncated, read each changed file individually until you have seen every changed line
143. List all files modified in this branch before proceeding
15 
16## Phase 2: Attack Surface Mapping
17 
18For each changed file, identify and list:
19 
20* All user inputs (request params, headers, body, URL components)
21* All database queries
22* All authentication/authorization checks
23* All session/state operations
24* All external calls
25* All cryptographic operations
26 
27## Phase 3: Security Checklist (check EVERY item for EVERY file)
28 
29* [ ] **Injection**: SQL, command, template, header injection
30* [ ] **XSS**: All outputs in templates properly escaped?
31* [ ] **Authentication**: Auth checks on all protected operations?
32* [ ] **Authorization/IDOR**: Access control verified, not just auth?
33* [ ] **CSRF**: State-changing operations protected?
34* [ ] **Race conditions**: TOCTOU in any read-then-write patterns?
35* [ ] **Session**: Fixation, expiration, secure flags?
36* [ ] **Cryptography**: Secure random, proper algorithms, no secrets in logs?
37* [ ] **Information disclosure**: Error messages, logs, timing attacks?
38* [ ] **DoS**: Unbounded operations, missing rate limits, resource exhaustion?
39* [ ] **Business logic**: Edge cases, state machine violations, numeric overflow?
40 
41## Phase 4: Verification
42 
43For each potential issue:
44 
45* Check if it's already handled elsewhere in the changed code
46* Search for existing tests covering the scenario
47* Read surrounding context to verify the issue is real
48 
49## Phase 5: Pre-Conclusion Audit
50 
51Before finalizing, you MUST:
52 
531. List every file you reviewed and confirm you read it completely
542. List every checklist item and note whether you found issues or confirmed it's clean
553. List any areas you could NOT fully verify and why
564. Only then provide your final findings
57 
58## Output Format
59 
60**Prioritize**: security vulnerabilities > bugs > code quality
61 
62**Skip**: stylistic/formatting issues
63 
64For each issue:
65 
66* **File:Line** - Brief description
67* **Severity**: Critical/High/Medium/Low
68* **Problem**: What's wrong
69* **Evidence**: Why this is real (not already fixed, no existing test, etc.)
70* **Fix**: Concrete suggestion
71* **References**: OWASP, RFCs, or other standards if applicable
72 
73If you find nothing significant, say so - don't invent issues.
74 
75Do not make changes - just report findings. I'll decide what to address.
76