Official adversary catalog

Reviews TypeScript adversaries for SDK usage, rule design, finding quality, tests, packaging, and publish readiness.

Reviews Depot CI workflows for security, correctness, reliability, caching, and performance concerns.

Reviews GitHub Actions workflows for security, supply-chain, and reliability defects.

Reviews GitLab CI for privileged runners, secret leakage, mutable images, release safety, and unpinned includes.

Reviews Compose services for privilege, host access, and image reproducibility.

Reviews Dockerfile-style files for container build and runtime security concerns.

Reviews Helm charts for excessive RBAC, privileged defaults, mutable images, and dependency pinning.

Reviews Kubernetes manifests for workload isolation, selector integrity, RBAC, and image safety.

Reviews Kustomize overlays for mutable resources, image tags, and literal secrets.

Reviews npm projects for dangerous lifecycle scripts, auto-update cooldowns, and lockfile integrity.

Reviews Yarn projects for unsafe configuration and incomplete dependency-resolution inputs.

Reviews ElasticClaw workspaces, workflows, goals, agents, and execution policies for correctness, maintainability, reliability, and efficiency.

Reviews Go command-line applications for predictable configuration, cancellation, diagnostics, and exit behavior.

Reviews Go concurrency lifecycle, cancellation, synchronization, and channel ownership.

Reviews Go database code for transaction, pool, query, cancellation, and migration safety.

Reviews Go HTTP services for bounded requests, safe middleware, and production-ready server lifecycle.

Reviews Go module metadata for reproducibility, upgrade safety, and maintainable dependency ownership.

Reviews Go logs, traces, metrics, context propagation, and telemetry lifecycle defects.

Reviews Go for resource amplification, defer-in-loop, per-request clients, hot-path regexp compilation, and quadratic string building.

Reviews Go repository hygiene: build-script prerequisites, pipe-to-shell scripts, committed binaries, CI toolchain skew, and license presence.

Reviews Go trust boundaries, authentication, cryptography, transport security, and secret handling.

Reviews Go tests for broken harnesses, flaky shared state, and selector oracles that preserve trivial boundary implementations.

Reviews Terraform for public exposure, secrets in HCL, encryption, and module pinning.

Go language pack — runs the full Go specialist suite (concurrency, security, http, modules, …) plus this package’s own TLS/shell/permissions checks.

Reviews Node.js for security hazards and lifecycle cleanup leaks.

Reviews Python for shell injection, unsafe deserialization, disabled TLS, and SQL string building.

Reviews TypeScript correctness, type design, async lifecycles, module boundaries, and runtime alignment.

Reviews code changes for implementation complexity that appears disproportionate to the behavior being added.

Reviews proposed changes with Staff-level engineering judgment across languages.

Scans repository text for committed credentials and narrow credential exposure paths.

Reviews Next.js configuration for unsafe remote content, exposed source maps, and framework boundary risks.

Reviews React source for raw HTML injection, opener attacks, and dynamic code execution.