Official doomer catalog

Reviews Depot CI workflows for security, correctness, reliability, caching, and performance concerns.

Reviews GitHub Actions workflows for security, supply-chain, and reliability defects.

Reviews GitLab CI for privileged runners, secret leakage, mutable images, release safety, and unpinned includes.

Reviews Compose services for privilege, host access, and image reproducibility.

Reviews Dockerfile-style files for container build and runtime security concerns.

Reviews Helm charts for excessive RBAC, privileged defaults, mutable images, and dependency pinning.

Reviews Kubernetes manifests for workload isolation, selector integrity, RBAC, and image safety.

Reviews Kustomize overlays for mutable resources, image tags, and literal secrets.

Reviews npm projects for dangerous lifecycle scripts, auto-update cooldowns, and lockfile integrity.

Reviews Yarn projects for unsafe configuration and incomplete dependency-resolution inputs.

Reviews ElasticClaw workspaces, workflows, goals, agents, and execution policies for correctness, maintainability, reliability, and efficiency.

Reviews Go command-line applications for predictable configuration, cancellation, diagnostics, and exit behavior.

Reviews Go concurrency lifecycle, cancellation, synchronization, and channel ownership.

Reviews Go database code for transaction, pool, query, cancellation, and migration safety.

Reviews Go HTTP services for bounded requests, safe middleware, and production-ready server lifecycle.

Reviews Go module metadata for reproducibility, upgrade safety, and maintainable dependency ownership.

Reviews Go logs, traces, metrics, context propagation, and telemetry lifecycle defects.

Reviews Go for resource amplification, defer-in-loop, per-request clients, hot-path regexp compilation, and quadratic string building.

Reviews Go repository hygiene: shell-harness readiness, build-script prerequisites, supply-chain hazards, CI toolchain skew, and license presence.

Reviews Go trust boundaries, authentication, cryptography, transport security, and secret handling.

Reviews Go tests for broken harnesses, flaky shared state, incomplete cross-entrypoint contracts, and oracles that preserve trivial defects.

Reviews Terraform for public exposure, secrets in HCL, encryption, and module pinning.

Reviews C and C++ language contracts, beginning with header linkage and build-mode safety.

Go language pack — runs the full Go specialist suite (concurrency, security, http, modules, …) plus this package’s own TLS/shell/permissions checks.

Reviews JavaScript projects for security hazards, lifecycle cleanup leaks, and configured project-linter diagnostics.

Reviews Python for security, reliability, and correctness hazards, including expiring OAuth bearer reuse.

Reviews TypeScript correctness, type design, async lifecycles, module boundaries, and runtime alignment.

Reviews TypeScript adversaries for SDK usage, rule design, finding quality, tests, packaging, and publish readiness.

Reviews exact software changes broadly, then independently verifies each proposed finding.

Reviews code changes for implementation complexity that appears disproportionate to the behavior being added.

Reviews changed code against declared repository rules and well-supported conventions inferred from existing code.

Reviews proposed changes with Staff-level engineering judgment across languages.

Non-blocking style and taste nits — naming, stale comments, unfinished renames, and similar maintainer cleanup. Not correctness; not a full design review.

Scans repository text for committed credentials and narrow credential exposure paths.

Reviews Bash and POSIX shell scripts with ShellCheck and evidence-backed model analysis.

Reviews Next.js configuration for unsafe remote content, exposed source maps, and framework boundary risks.

Reviews Playwright tests for deterministic, isolated, behavior-verifying patterns.

Reviews React source for raw HTML injection, opener attacks, and dynamic code execution.