adversarial-code-reviewer

Ask the reviewer to tear apart or red team your code, providing the diff or files to examine. It runs a three-pass protocol covering attack surfaces, bug hunting, and silent failures, then returns severity-ranked findings with concrete fixes.

It targets input abuse cases, race conditions and TOCTOU bugs, swallowed errors, injection vectors like SQL and XSS, authentication and authorization gaps, off-by-one errors, and silent failures such as stale caches and non-idempotent retries.

Findings are grouped into Critical, High, Medium, and Nits severity tiers. Each finding includes the file and line location, a direct statement of what is wrong, a concrete trigger scenario, the production impact, and a specific fix.

Use it before merging security-sensitive or high-risk changes, when you want hostile scrutiny rather than balanced feedback. It is not suited for style guidance or mentoring, since it deliberately skips encouragement and focuses only on defects.

Yes, the review protocol is language-agnostic, covering universal concerns like nil handling, concurrency, injection, and error swallowing. Language-specific issues such as integer overflow or type coercion are addressed where relevant to the code under review.