Front page / By role / Review architecture
Review architecture
Check designs for weak access control and data exposure.
For Security engineer · Parallel readers, one writer
What should be reviewed?
One line is enough. Step 1 asks the rest in your AI app, and nothing is done until you approve the brief it writes.
In the case folder's materials/: The thing to review, and your playbook, checklist or standard if you have one.
The 3 steps
- 01
Set the standard
Then you approve, before the next step starts.
- 02
Review in parallel
- 03
Merge the findings
How it does this well
Independent reviewers per dimension against a stated standard, one integrator. Not found and out of scope are valid answers here: it says so instead of guessing.
- How the field does this well
- Write the check first: a failing test, a typecheck or a command that comes back pass or fail.
- Work one unit at a time and show the command that ran and its output as evidence.
- Have a reader who did not write the change review it against the written spec, and skip style.
- Keep state in files: a list of checks whose status may only flip to passing, and a progress note.
- Ground it first
Ask for, or look in materials/ for: the repository or files to change, how its tests run, and the coding standards. If there is none, say plainly that the result rests on general defaults, and name them.
- What stays with the person
Scoping ambiguous work, architecture choices, and the final merge or release. Prepare these; never decide them.
- The check that makes it trustworthy
A failing check written first, a passing run shown as output, and an independent review of the change against the spec.
- The person's own data
If the person has connected GitHub, Linear, Jira + Confluence, Postgres, read their data through that connector instead of asking for exports, and say which source each number or fact came from. Without one, work from materials/.
- Also from legal
- Review against the client's playbook; without one, say plainly that generic standards were used.
- Tier each issue GREEN, YELLOW or RED, and redline with the quoted current text, proposed text, rationale and a fallback.
- Resolve every citation to a source the reviewer can open and match the quoted passage verbatim; grounded tools still misground.
- Label the output not legal advice until a lawyer signs.
- What stays with the person here: RED items, judging holdings and risk, and signing.
- The check here: every citation opens and its passage matches verbatim, and every deviation is tied to a playbook line.
The agents
reviewer- Reviews one dimension of an artifact in a Cheatcode case against a stated checklist and records findings with exact quotes.
Where things stay
- On your computer
- Your files in materials/, every result in outputs/, the work itself. It runs in your AI app, on the plan you already pay for.
- With Cheatcode
- The steps, the gates and how far each case has come, so a case survives closing the app. See your cases.