awesome-skills/code-review-skill

[Credential-related source omitted]

<p>   <a href="https://github.com/awesome-skills/code-review-skill/blob/main/LICENSE">

<a href="https://github.com/awesome-skills/code-review-skill/blob/main/LICENSE">

<img src="https://img.shields.io/badge/License-MIT-22c55e?style=flat-square" alt="License: MIT"/>

</a>   <img src="https://img.shields.io/badge/Claude_Code-Skill-7c3aed?style=flat-square&logo=anthropic&logoColor=white" alt="Claude Code Skill"/>   <img src="https://img.shields.io/badge/Total_Lines-21%2C000%2B-3b82f6?style=flat-square" al

<img src="https://img.shields.io/badge/Claude_Code-Skill-7c3aed?style=flat-square&logo=anthropic&logoColor=white" alt="Claude Code Skill"/>

<img src="https://img.shields.io/badge/Total_Lines-21%2C000%2B-3b82f6?style=flat-square" alt="21000+ lines"/>

<img src="https://img.shields.io/badge/Languages-20%2B-f59e0b?style=flat-square" alt="20+ languages"/>

<img src="https://img.shields.io/badge/PRs-Welcome-ec4899?style=flat-square" alt="PRs Welcome"/>

**Code Review Skill** is a production-ready skill for [Claude Code](https://claude.ai/code) that transforms AI-assisted code review from vague suggestions into a **structured, consistent, and expert-level** process.

# macOS / Linux git clone https://github.com/awesome-skills/code-review-skill.git \

git clone https://github.com/awesome-skills/code-review-skill.git \

# Windows (PowerShell) git clone https://github.com/awesome-skills/code-review-skill.git `

git clone https://github.com/awesome-skills/code-review-skill.git `

MIT © [awesome-skills](https://github.com/awesome-skills)

**Code Review Skill** 是专为 [Claude Code](https://claude.ai/code) 打造的生产级代码审查技能，将 AI 辅助的代码审查从模糊建议转变为**结构化、一致且专业级**的流程。

# macOS / Linux git clone https://github.com/awesome-skills/code-review-skill.git \

git clone https://github.com/awesome-skills/code-review-skill.git \

# Windows（PowerShell） git clone https://github.com/awesome-skills/code-review-skill.git `

git clone https://github.com/awesome-skills/code-review-skill.git `

MIT © [awesome-skills](https://github.com/awesome-skills)

Bash

<meta name="viewport" content="width=device-width, initial-scale=1.0">   <title>code-review-skill(1) — User Commands (en_US)</title>   <link rel="preconnect" href="https://fonts.googleapis.com">

<title>code-review-skill(1) — User Commands (en_US)</title>   <link rel="preconnect" href="https://fonts.googleapis.com">   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

<link rel="preconnect" href="https://fonts.googleapis.com">

<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">

<span class="cmt"># or clone into the Claude Code skills directory — macOS / Linux</span> <span class="prompt">$</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> \

<span class="prompt">$</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> \

<span class="cmt"># Windows PowerShell</span> <span class="prompt">PS&gt;</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> `

<span class="prompt">PS&gt;</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> `

<section class="body">     <p>       <a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,

<p>       <a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,       <a class="link" href="https://github.com/awesome-skills/code-review-skill" target="_blank">github / awesome-skills</a>,

<a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill" target="_blank">github / awesome-skills</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill/blob/main/CONTRIBUTING.md" target="_blank">CONTRIBUTING(7)</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill/blob/main/assets/review-checklist.md" target="_blank">review-checklist(7)</a>

<dd>maintainer, primary author</dd>       <dt>contributors</dt>       <dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>

<dt>contributors</dt>       <dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>     </dl>

<dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>

<meta name="viewport" content="width=device-width, initial-scale=1.0">   <title>code-review-skill(1) — User Commands</title>   <link rel="preconnect" href="https://fonts.googleapis.com">

<title>code-review-skill(1) — User Commands</title>   <link rel="preconnect" href="https://fonts.googleapis.com">   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

<link rel="preconnect" href="https://fonts.googleapis.com">

<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

<link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">

<span class="cmt"># 或克隆到 Claude Code skills 目录 — macOS / Linux</span> <span class="prompt">$</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> \

<span class="prompt">$</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> \

<span class="cmt"># Windows PowerShell</span> <span class="prompt">PS&gt;</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> `

<span class="prompt">PS&gt;</span> <span class="cmd">git clone</span> <span class="arg">https://github.com/awesome-skills/code-review-skill.git</span> `

<section class="body">     <p>       <a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,

<p>       <a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,       <a class="link" href="https://github.com/awesome-skills/code-review-skill" target="_blank">github / awesome-skills</a>,

<a class="link" href="https://claude.ai/code" target="_blank">claude-code(1)</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill" target="_blank">github / awesome-skills</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill/blob/main/CONTRIBUTING.md" target="_blank">CONTRIBUTING(7)</a>,

<a class="link" href="https://github.com/awesome-skills/code-review-skill/blob/main/assets/review-checklist.md" target="_blank">review-checklist(7)</a>

<dd>maintainer, primary author</dd>       <dt>contributors</dt>       <dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>

<dt>contributors</dt>       <dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>     </dl>

<dd>see <a class="link" href="https://github.com/awesome-skills/code-review-skill/graphs/contributors" target="_blank">graphs/contributors</a></dd>

// ❌ 使用字符串 token——易冲突且无类型安全 providers: [{ provide: 'API_URL', useValue: 'https://api.example.com' }]

providers: [{ provide: 'API_URL', useValue: 'https://api.example.com' }]

providers: [{ provide: API_URL, useValue: 'https://api.example.com' }]

- [Clean Architecture - Uncle Bob](https://blog.cleancoder.com/uncle-bob/2012/08/13/the-clean-architecture.html)

- [SOLID Principles in Code Review - JetBrains](https://blog.jetbrains.com/upsource/2015/08/31/what-to-look-for-in-a-code-review-solid-principles-2/)

- [Software Architecture Anti-Patterns](https://medium.com/@christophnissle/anti-patterns-in-software-architecture-3c8970c9c4f5)

- [Coupling and Cohesion in System Design](https://www.geeksforgeeks.org/system-design/coupling-and-cohesion-in-system-design/)

- [Design Patterns - Refactoring Guru](https://refactoring.guru/design-patterns)

[Credential-related source omitted]

// ❌ Copy-paste handler 只改了 URL async function deletePost(id: string) {   await fetch(`/api/posts/${id}`, { method: "DELETE" });

async function deletePost(id: string) {   await fetch(`/api/posts/${id}`, { method: "DELETE" });   router.push("/posts");

await fetch(`/api/posts/${id}`, { method: "DELETE" });

} async function deleteComment(id: string) {   await fetch(`/api/comments/${id}`, { method: "DELETE" });

async function deleteComment(id: string) {   await fetch(`/api/comments/${id}`, { method: "DELETE" });   router.push("/comments");

await fetch(`/api/comments/${id}`, { method: "DELETE" });

// ✅ 参数化 async function deleteResource(resource: string, id: string) {   await fetch(`/api/${resource}/${id}`, { method: "DELETE" });

async function deleteResource(resource: string, id: string) {   await fetch(`/api/${resource}/${id}`, { method: "DELETE" });   router.push(`/${resource}`);

await fetch(`/api/${resource}/${id}`, { method: "DELETE" });

useEffect(() => {   const interval = setInterval(() => {     fetch("/api/status").then(r => r.json()).then(setStatus);

const interval = setInterval(() => {     fetch("/api/status").then(r => r.json()).then(setStatus);   }, 5000);

fetch("/api/status").then(r => r.json()).then(setStatus);

useEffect(() => {   const interval = setInterval(() => {     fetch("/api/status")

const interval = setInterval(() => {     fetch("/api/status")       .then(r => r.json())

fetch("/api/status")

TEST(UserServiceTest, FetchesUserProfile) {     MockHttpClient client;     EXPECT_CALL(client, get("https://api.example.com/user/1"))

MockHttpClient client;     EXPECT_CALL(client, get("https://api.example.com/user/1"))         .WillOnce(Return(HttpResponse{200, R"({"name":"Alice"})"}));

EXPECT_CALL(client, get("https://api.example.com/user/1"))

# ❌ Python: 在 async 函数中使用同步 I/O 阻塞事件循环 async def handle():     result = requests.get(url)  # 阻塞！整个事件循环停滞

async def handle():     result = requests.get(url)  # 阻塞！整个事件循环停滞     return result

result = requests.get(url)  # 阻塞！整个事件循环停滞

# ✅ 使用异步 I/O 或将阻塞操作放到线程池 async def handle():     result = await aiohttp.get(url)  # 非阻塞

async def handle():     result = await aiohttp.get(url)  # 非阻塞     return result

result = await aiohttp.get(url)  # 非阻塞

async def fetch_one(url: str):         async with semaphore:             return await aiohttp.get(url)

return await aiohttp.get(url)

sem <- struct{}{}        // 获取信号量             defer func() { <-sem }() // 释放信号量             return fetch(ctx, url)

defer func() { <-sem }() // 释放信号量             return fetch(ctx, url)         })

return fetch(ctx, url)

async function processPayment(orderId: string): Promise<Receipt> {     try {         const response = await fetch(url, { method: 'POST', body: payload });

try {         const response = await fetch(url, { method: 'POST', body: payload });         if (!response.ok) {

const response = await fetch(url, { method: 'POST', body: payload });

// ❌ Vulnerable: string concatenation $sql = "SELECT * FROM users WHERE email = '" . $_GET['email'] . "'"; $user = $pdo->query($sql)->fetch();

$user = $pdo->query($sql)->fetch();

$stmt = $pdo->prepare("SELECT * FROM users WHERE email = :email"); $stmt->execute(['email' => $email]); $user = $stmt->fetch(PDO::FETCH_ASSOC);

$user = $stmt->fetch(PDO::FETCH_ASSOC);

# Automated scanning sqlmap -u "https://example.com/api/users?id=1" --batch

sqlmap -u "https://example.com/api/users?id=1" --batch

| **DOM-based** | Client-side JavaScript modifies the DOM unsafely | `innerHTML`, `document.write()`, `eval()` |

const result = eval(userInput);

- `script-src 'unsafe-eval'` (enables `eval()`)

# Automated scanning # OWASP ZAP zap-cli quick-scan --spider https://example.com

zap-cli quick-scan --spider https://example.com

- [ ] No `eval()`, `new Function()`, or `javascript:` URLs with user input

// ❌ 每次请求创建新的 HttpClient——socket 耗尽 using var client = new HttpClient(); var response = await client.GetAsync("https://api.example.com/data");

var response = await client.GetAsync("https://api.example.com/data");

- [ ] 是否检查了 [Can I Use](https://caniuse.com)？

| 工具 | 用途 | |------|------| | [Stylelint](https://stylelint.io/) | CSS 代码检查 |

|------|------| | [Stylelint](https://stylelint.io/) | CSS 代码检查 | | [PurgeCSS](https://purgecss.com/) | 移除未使用 CSS |

| [Stylelint](https://stylelint.io/) | CSS 代码检查 |

| [PurgeCSS](https://purgecss.com/) | 移除未使用 CSS |

| [Autoprefixer](https://autoprefixer.github.io/) | 自动添加前缀 |

| [CSS Stats](https://cssstats.com/) | 分析 CSS 统计 |

| [Can I Use](https://caniuse.com/) | 浏览器兼容性查询 |

- [CSS Performance Optimization - MDN](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Performance/CSS)

- [What a CSS Code Review Might Look Like - CSS-Tricks](https://css-tricks.com/what-a-css-code-review-might-look-like/)

- [How to Animate Box-Shadow - Tobias Ahlin](https://tobiasahlin.com/blog/how-to-animate-box-shadow/)

- [Media Query Fundamentals - MDN](https://developer.mozilla.org/en-US/docs/Learn_web_development/Core/CSS_layout/Media_queries)

- [Autoprefixer - GitHub](https://github.com/postcss/autoprefixer)

Future<void> _load() async {   final data = await api.fetch();

final data = await api.fetch();

Future<void> _load() async {   final data = await api.fetch();

final data = await api.fetch();

- [Dart language tour (null safety)](https://dart.dev/null-safety)

- [Effective Dart](https://dart.dev/effective-dart)

- [Flutter performance: best practices](https://docs.flutter.dev/perf/best-practices)

- [FutureBuilder class](https://api.flutter.dev/flutter/widgets/FutureBuilder-class.html)

- [Isolate.run](https://api.dart.dev/stable/dart-isolate/Isolate/run.html)

- [Riverpod: Refs (`watch` vs `read`)](https://riverpod.dev/docs/concepts2/refs)

- [Bloc: BlocListener vs BlocBuilder](https://bloclibrary.dev/bloc-concepts/)

- [Key class](https://api.flutter.dev/flutter/foundation/Key-class.html)

# ✅ 前端 AJAX 请求带上 CSRF token # JavaScript: fetch("/api/endpoint/", {

# JavaScript: fetch("/api/endpoint/", {

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# ✅ 限制允许的来源 CORS_ALLOWED_ORIGINS = [     "https://example.com",

CORS_ALLOWED_ORIGINS = [     "https://example.com",     "https://app.example.com",

"https://example.com",

"https://app.example.com",

[Credential-related source omitted]

# ❌ Bad — a new HTTP client (and connection pool) per request @app.get("/proxy") async def proxy(client: httpx.AsyncClient = Depends(lambda: httpx.AsyncClient())):

@app.get("/proxy") async def proxy(client: httpx.AsyncClient = Depends(lambda: httpx.AsyncClient())):     ...

async def proxy(client: httpx.AsyncClient = Depends(lambda: httpx.AsyncClient())):

@asynccontextmanager async def lifespan(app: FastAPI):     app.state.http = httpx.AsyncClient()

async def lifespan(app: FastAPI):     app.state.http = httpx.AsyncClient()     yield

app.state.http = httpx.AsyncClient()

@app.get("/report") async def report():     data = requests.get("https://slow-api.example.com").json()  # blocking socket

async def report():     data = requests.get("https://slow-api.example.com").json()  # blocking socket     time.sleep(2)                                                # blocks the loop

data = requests.get("https://slow-api.example.com").json()  # blocking socket

@app.get("/report") async def report(client: httpx.AsyncClient = Depends(get_http)):     resp = await client.get("https://slow-api.example.com")

async def report(client: httpx.AsyncClient = Depends(get_http)):     resp = await client.get("https://slow-api.example.com")     return resp.json()

resp = await client.get("https://slow-api.example.com")

@app.get("/users/{uid}") def get_user(uid: int):     return asyncio.run(repo.fetch(uid))  # RuntimeError under the running loop

return asyncio.run(repo.fetch(uid))  # RuntimeError under the running loop

@app.get("/users/{uid}") async def get_user(uid: int):     return await repo.fetch(uid)

return await repo.fetch(uid)

app.add_middleware(     CORSMiddleware,     allow_origins=["https://app.example.com"],

CORSMiddleware,     allow_origins=["https://app.example.com"],     allow_credentials=True,

allow_origins=["https://app.example.com"],

# Act: Bob tries to delete Alice's document     transport = ASGITransport(app=app)     async with AsyncClient(transport=transport, base_url="http://test") as client:

transport = ASGITransport(app=app)     async with AsyncClient(transport=transport, base_url="http://test") as client:         resp = await client.delete("/documents/10", headers={"X-Test-User": "bob"})

async with AsyncClient(transport=transport, base_url="http://test") as client:

- [FastAPI official documentation](https://fastapi.tiangolo.com/) — async, dependencies, testing

- [zhanymkanov/fastapi-best-practices](https://github.com/zhanymkanov/fastapi-best-practices) — production conventions (async routes, dependency caching, project structure)

- [Effective Go](https://go.dev/doc/effective_go)

- [Go Code Review Comments](https://go.dev/wiki/CodeReviewComments)

- [Go Common Mistakes](https://go.dev/wiki/CommonMistakes)

- [100 Go Mistakes](https://100go.co/)

- [Go Proverbs](https://go-proverbs.github.io/)

- [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md)

- [What to Look for in Java 8 Code (JetBrains)](https://blog.jetbrains.com/upsource/2016/08/03/what-to-look-for-in-java-8-code/)

- [JDK-8148463: Collectors.toMap fails on null values](https://bugs.openjdk.org/browse/JDK-8148463)

- [Oracle Tutorial: Parallelism](https://docs.oracle.com/javase/tutorial/collections/streams/parallelism.html)

- [Baeldung: Migrating to Java 8 Date/Time API](https://www.baeldung.com/migrating-to-java-8-date-time-api)

- [Baeldung: CompletableFuture and ThreadPool](https://www.baeldung.com/java-completablefuture-threadpool)

- [Spring Boot RestTemplate customization](https://docs.spring.io/spring-boot/docs/2.7.x/reference/html/io.html#io.rest-client.resttemplate)

- [Thorben Janssen: Hibernate/JPA Date and Time](https://thorben-janssen.com/hibernate-jpa-date-and-time/)

| 工具 | 用途 | |------|------| | [Lighthouse](https://developer.chrome.com/docs/lighthouse/) | Core Web Vitals 测试 |

|------|------| | [Lighthouse](https://developer.chrome.com/docs/lighthouse/) | Core Web Vitals 测试 | | [WebPageTest](https://www.webpagetest.org/) | 详细性能分析 |

| [Lighthouse](https://developer.chrome.com/docs/lighthouse/) | Core Web Vitals 测试 |

| [WebPageTest](https://www.webpagetest.org/) | 详细性能分析 |

| [webpack-bundle-analyzer](https://github.com/webpack-contrib/webpack-bundle-analyzer) | Bundle 分析 |

| [Chrome DevTools Performance](https://developer.chrome.com/docs/devtools/performance/) | 运行时性能分析 |

| 工具 | 用途 | |------|------| | [MemLab](https://github.com/facebookincubator/memlab) | 自动化内存泄漏检测 |

|------|------| | [MemLab](https://github.com/facebookincubator/memlab) | 自动化内存泄漏检测 | | Chrome Memory Tab | 堆快照分析 |

| [MemLab](https://github.com/facebookincubator/memlab) | 自动化内存泄漏检测 |

|------|------| | EXPLAIN | 数据库查询计划分析 | | [pganalyze](https://pganalyze.com/) | PostgreSQL 性能监控 |

| EXPLAIN | 数据库查询计划分析 | | [pganalyze](https://pganalyze.com/) | PostgreSQL 性能监控 | | [New Relic](https://newrelic.com/) / [Datadog](https://www.datadoghq.com/) | APM 监控 |

| [pganalyze](https://pganalyze.com/) | PostgreSQL 性能监控 |

| [New Relic](https://newrelic.com/) / [Datadog](https://www.datadoghq.com/) | APM 监控 |

- [Core Web Vitals - web.dev](https://web.dev/articles/vitals)

- [Optimizing Core Web Vitals - Vercel](https://vercel.com/guides/optimizing-core-web-vitals-in-2024)

- [MemLab - Meta Engineering](https://engineering.fb.com/2022/09/12/open-source/memlab/)

- [Big O Cheat Sheet](https://www.bigocheatsheet.com/)

- [N+1 Query Problem - Stack Overflow](https://stackoverflow.com/questions/97197/what-is-the-n1-selects-problem-in-orm-object-relational-mapping)

- [API Performance Optimization](https://algorithmsin60days.com/blog/optimizing-api-performance/)

[Credential-related source omitted]

[Credential-related source omitted]

PDO connections are usually managed by the container, but file handles, curl handles, temp files, locks, and cached objects in queue workers still need an explicit lifecycle.

- [PHP Manual: Type declarations](https://www.php.net/manual/en/language.types.declarations.php)

- [PHP Manual: match](https://www.php.net/match)

- [PHP Manual: Enumerations](https://www.php.net/manual/en/language.enumerations.overview.php)

- [PHP Manual: Properties](https://www.php.net/manual/en/language.oop5.properties.php)

- [PHP Manual: PDO](https://www.php.net/manual/en/class.pdo.php)

- [PHP Manual: password_hash](https://www.php.net/manual/en/function.password-hash.php)

- [PHP Manual: random_bytes](https://www.php.net/manual/en/function.random-bytes.php)

- [Composer documentation](https://getcomposer.org/doc/)

- [PHPUnit documentation](https://docs.phpunit.de/)

- [PHPStan documentation](https://phpstan.org/user-guide/getting-started)

- [Psalm documentation](https://psalm.dev/docs/)

results = []     for url in urls:         results.append(requests.get(url).text)  # 串行执行

for url in urls:         results.append(requests.get(url).text)  # 串行执行     return results

results.append(requests.get(url).text)  # 串行执行

# ✅ 异步并发调用 async def fetch_url(url: str) -> str:     async with aiohttp.ClientSession() as session:

async def fetch_url(url: str) -> str:     async with aiohttp.ClientSession() as session:         async with session.get(url) as response:

async with aiohttp.ClientSession() as session:

async def query_data():     async with get_connection() as conn:         return await conn.fetch("SELECT * FROM users")

return await conn.fetch("SELECT * FROM users")

# ✅ 使用异步迭代 async def process_all_pages():     async for page in fetch_pages("https://api.example.com"):

async def process_all_pages():     async for page in fetch_pages("https://api.example.com"):         await process_page(page)

async for page in fetch_pages("https://api.example.com"):

function ClientForm() {   const handleSubmit = async (formData: FormData) => {     const res = await fetch('/api/submit', {

const handleSubmit = async (formData: FormData) => {     const res = await fetch('/api/submit', {       method: 'POST',

const res = await fetch('/api/submit', {

operation = OPERATIONS.fetch(params[:operation])

Order.order(SORTS.fetch(params[:sort], SORTS.fetch("newest")))

order = Orders::CreateOnce.call(   actor: current_user,   idempotency_key: request.headers.fetch("Idempotency-Key"),

actor: current_user,   idempotency_key: request.headers.fetch("Idempotency-Key"),   attributes: order_params

idempotency_key: request.headers.fetch("Idempotency-Key"),

- [Ruby Releases](https://www.ruby-lang.org/en/downloads/releases/)

- [Ruby Syntax: Methods and Arguments](https://ruby-doc.org/3.4/syntax/methods_rdoc.html)

- [Ruby Syntax: Exceptions](https://ruby-doc.org/3.4/syntax/exceptions_rdoc.html)

- [Rails Action Controller Overview](https://guides.rubyonrails.org/action_controller_overview.html)

- [Rails Active Record Query Interface](https://guides.rubyonrails.org/active_record_querying.html)

- [Rails Active Record Transactions](https://api.rubyonrails.org/classes/ActiveRecord/Transactions/ClassMethods.html)

- [Rails Active Job Basics](https://guides.rubyonrails.org/active_job_basics.html)

- [Securing Rails Applications](https://guides.rubyonrails.org/security.html)

- [Testing Rails Applications](https://guides.rubyonrails.org/testing.html)

- [RuboCop Documentation](https://docs.rubocop.org/rubocop/)

- [RuboCop Rails Documentation](https://docs.rubocop.org/rubocop-rails/)

- [Brakeman](https://brakemanscanner.org/)

[Credential-related source omitted]

import requests url = request.GET.get('url') response = requests.get(url)

response = requests.get(url)

if is_safe_url(url):     response = requests.get(url)

response = requests.get(url)

// ❌ Vulnerable: fetching arbitrary URLs const url = req.query.url; const response = await fetch(url);

const response = await fetch(url);

exec(`convert ${filename} output.png`);

exec(`echo ${userInput}`);  // userInput = "; rm -rf /"

// ✅ Restrictive CORS app.use(cors({   origin: ['https://your-app.com'],

app.use(cors({   origin: ['https://your-app.com'],   methods: ['GET', 'POST'],

origin: ['https://your-app.com'],

export async function load({ fetch, parent }) {   const [analytics, notifications] = await Promise.all([     fetch('/api/analytics').then(r => r.json()),

const [analytics, notifications] = await Promise.all([     fetch('/api/analytics').then(r => r.json()),     fetch('/api/notifications').then(r => r.json())

fetch('/api/analytics').then(r => r.json()),

fetch('/api/notifications').then(r => r.json())

export async function load({ parent, fetch }) {   const parentData = await parent();  // wait for parent   const post = await fetch(`/api/posts/${parentData.blogId}`);

const parentData = await parent();  // wait for parent   const post = await fetch(`/api/posts/${parentData.blogId}`);   return { post };

const post = await fetch(`/api/posts/${parentData.blogId}`);

export async function load({ parent, fetch }) {   // only await parent if you truly need its data   const post = await fetch('/api/posts/slug');

// only await parent if you truly need its data   const post = await fetch('/api/posts/slug');   return { post };

const post = await fetch('/api/posts/slug');

export async function load({ parent, fetch }) {   const { blogId } = await parent();  // required: need blogId for post URL   const post = await fetch(`/api/posts/${blogId}`);

const { blogId } = await parent();  // required: need blogId for post URL   const post = await fetch(`/api/posts/${blogId}`);   return { post };

const post = await fetch(`/api/posts/${blogId}`);

async function deleteUser(id: string) {     await fetch(`/api/users/${id}`, { method: 'DELETE' });

await fetch(`/api/users/${id}`, { method: 'DELETE' });

[Credential-related source omitted]

export async function load({ locals }) {   // secrets stay on server   const data = await fetch(process.env.SECRET_API_KEY + '/admin');

// secrets stay on server   const data = await fetch(process.env.SECRET_API_KEY + '/admin');   return { data };  // only derived data is sent to client

[Credential-related source omitted]

[Credential-related source omitted]

// ✅ 公开变量使用 PUBLIC_ 前缀 // .env // PUBLIC_API_URL=https://api.example.com

[Credential-related source omitted]

[Credential-related source omitted]

// PUBLIC_API_URL=https://api.example.com

[Credential-related source omitted]

func fetch(_ path: String) throws -> Data {

try await withThrowingTaskGroup(of: Item.self) { group in     for id in ids {         group.addTask { try await fetch(id) }

for id in ids {         group.addTask { try await fetch(id) }     }

group.addTask { try await fetch(id) }

- [Swift API Design Guidelines](https://www.swift.org/documentation/api-design-guidelines/)

- [The Swift Programming Language](https://docs.swift.org/swift-book/)

- [Swift Concurrency (TSPL)](https://docs.swift.org/swift-book/documentation/the-swift-programming-language/concurrency/)

- [Migrating to Swift 6](https://www.swift.org/migration/documentation/migrationguide/)

- [Apple: Managing Model Data in Your App (SwiftUI)](https://developer.apple.com/documentation/swiftui/managing-model-data-in-your-app)

- [Apple: Automatic Reference Counting](https://docs.swift.org/swift-book/documentation/the-swift-programming-language/automaticreferencecounting/)

- [WWDC: Protocol-Oriented Programming in Swift](https://developer.apple.com/videos/play/wwdc2015/408/)

- [Swift Evolution](https://github.com/apple/swift-evolution)

// ❌ Not handling async errors async function fetchUser(id: string) {   const response = await fetch(`/api/users/${id}`);

async function fetchUser(id: string) {   const response = await fetch(`/api/users/${id}`);   return response.json();  // 网络错误未处理

const response = await fetch(`/api/users/${id}`);

async function fetchUser(id: string): Promise<User> {   try {     const response = await fetch(`/api/users/${id}`);

try {     const response = await fetch(`/api/users/${id}`);     if (!response.ok) {

const response = await fetch(`/api/users/${id}`);

useEffect(() => {     fetch(`/api/search?q=${query}`)

fetch(`/api/search?q=${query}`)

fetch(`/api/search?q=${query}`, { signal: controller.signal })

const config = createConfig({   api: { url: 'https://api.example.com', version: 2 },

api: { url: 'https://api.example.com', version: 2 },

features: { newDashboard: true }, }); // config.api.url 类型是 'https://api.example.com'（字面量）

// config.api.url 类型是 'https://api.example.com'（字面量）

watch(searchQuery, async (query) => {   const controller = new AbortController()   const data = await fetch(`/api/search?q=${query}`, {

const controller = new AbortController()   const data = await fetch(`/api/search?q=${query}`, {     signal: controller.signal

const data = await fetch(`/api/search?q=${query}`, {

try {     const data = await fetch(`/api/search?q=${query}`, {

const data = await fetch(`/api/search?q=${query}`, {

try {       const response = await fetch(toValue(url))

const response = await fetch(toValue(url))

- [Zig 0.16.0 Language Reference](https://ziglang.org/documentation/0.16.0/)

- [Zig 0.16.0 Standard Library documentation](https://ziglang.org/documentation/0.16.0/std/)

- [Zig 0.16.0 Style Guide](https://ziglang.org/documentation/0.16.0/#Style-Guide)

- [Choosing an Allocator](https://ziglang.org/documentation/0.16.0/#Choosing-an-Allocator)

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env python3

[Credential-related source omitted]