Give me a short checklist for a boring auth review. I want something I can run before I call the work done.
A blunt review of my approach to a boring auth review
I wanted help with a boring auth review without pretending the model knew facts I had not provided.
Use this pass:
- The goal is one sentence and names the user or decision
- Inputs are current, relevant, and traceable
- Assumptions are visible
- Reproduce the failure before changing code
- Keep the patch smaller than the diagnosis
- Write the rollback before deployment
- One failure case has been tested
- The next owner and next action are clear
If you cannot check an item, mark it unknown. Do not quietly treat unknown as done.
Saving this. The unknown-versus-done line catches most of my shortcuts.
4 comments
Sign in to join the conversation.