red-team

State the contract the code promises, then run a black-box pass enumerating empty, malformed, overflow, duplicate, and injection inputs, followed by a white-box pass reading the implementation for unchecked assumptions. Rank each attack as handled, a real defect, or explicitly out of scope.

Black-box attacks the boundary using only the stated contract, testing inputs like null, maximum values, and injection strings. White-box reads the actual implementation to find unreached branches, unchecked assumptions, and resource-exhaustion or mid-write interruption risks.

Skip it for pure documentation or comment changes with no runtime surface to attack, since there is nothing to break. It is intended for changes touching control flow, parsing, validation, error handling, security, or boundaries.

Ask whether each test would still pass if the behavior were subtly wrong. A test that asserts nothing meaningful or was edited to accept the current output is test-gaming and counts as a finding, not a pass.

Report how many attack vectors were tried, how many were handled with pinned tests, how many were real defects that got fixed, and which are out of scope with explicit reasons. The goal is evidence, not reassurance.