> ## Documentation Index > Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt > Use this file to discover all available pages before exploring further. # Example Prompts > Explore framework-specific custom prompts for improving PR review coverage and compliance with your internal standards. The following examples provide targeted custom prompts that can be integrated into your AI-powered PR review workflows. Our customers find these particularly helpful for their repos across frameworks like Spring Boot and React. Use these as templates or extend them to align with your team’s coding standards and architectural principles. > [accordion] React > > ```mdx theme={"theme":"css-variables"} > ## Direct DOM Manipulation > Flag any use of `document.getElementById`, `querySelector`, `innerHTML`, or other direct DOM APIs inside React components (including in `useEffect`), since React’s virtual DOM and refs should be used instead. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Excessive Inline Styles > Flag JSX elements with large objects in `style={{…}}` - especially when reused - rather than defining CSS classes or styled-components for maintainability and performance. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Uncontrolled to Controlled Component Switch > Flag components that change from uncontrolled (no `value` prop) to controlled (with `value`) between renders, which can lead to React warnings and inconsistent state. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Stale Closures in Hooks > Flag cases where callbacks inside `useEffect` or `useCallback` reference state/props without listing them in the dependency array, as this causes outdated values to be used. > ``` > [accordion] Angular > > ```mdx theme={"theme":"css-variables"} > ## Direct DOM Access Bypassing Angular Renderer > Flag any `document.querySelector`, `element.nativeElement`, or jQuery usage in components - instead use `Renderer2` or Angular’s template bindings to stay framework-compliant. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Overuse of `any` in TypeScript > Flag function parameters or variables typed as `any` throughout services or components, which defeats Angular’s compile-time type safety. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Putting Business Logic in Templates > Flag complex expressions or loops in the HTML template (e.g., `*ngIf="computeSomething(x)"`), which should be moved into the component class for readability and testability. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Missing Subscription Cleanup > Flag subscriptions to `Observables` in `ngOnInit` that are not unsubscribed in `ngOnDestroy`, leading to memory leaks in long‐running applications. > ``` > [accordion] Vue.js > > ```mdx theme={"theme":"css-variables"} > ## Mutating `props` Directly > Flag any assignment to a prop inside a child component (e.g., `this.propValue = ...`), which should instead be emitted back to the parent or copied to local data. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Using `$forceUpdate` to Bypass Reactivity > Flag instances of `this.$forceUpdate()` or manually triggering watchers instead of fixing the reactive data flow. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Logic-heavy Templates > Flag templates containing complex JavaScript (e.g., inline methods or filters doing heavy computation) - move that logic into computed properties or methods in the component script. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unremoved Watchers and Event Listeners > Flag watchers or `$on` event handlers set up in `mounted()` that aren’t properly torn down in `beforeDestroy()`, which can cause memory leaks. > ``` > [accordion] Django > > ```mdx theme={"theme":"css-variables"} > ## Hardcoded Secrets in Settings > Flag any API keys, database passwords, or tokens hardcoded in `settings.py` instead of using environment variables (`os.getenv`) or a secrets manager. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Raw SQL without Parameterization > Flag any `cursor.execute(f"SELECT … {user_input}")` usage - instead use Django’s ORM or `cursor.execute("… WHERE x = %s", [user_input])` to prevent SQL injection. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Mass Assignment on Forms or Models > Flag `Model.objects.create(**request.POST)` or `form.save(commit=True)` without specifying `fields` or using `cleaned_data`, which can expose unintended fields. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unvalidated File Uploads > Flag file upload handlers (e.g., `request.FILES['file']`) that don’t check file type or size before saving, exposing the app to malicious uploads. > ``` > [accordion] Spring Boot > > ```mdx theme={"theme":"css-variables"} > ## Hardcoded Secrets or Credentials > Flag API keys, passwords, or tokens hardcoded in `.java` or `.properties` files. > ``` > > ```mdx theme={"theme":"css-variables"} > ## SQL Injection via Unparameterized Queries > Flag dynamic SQL built using string concatenation or user inputs without parameter binding. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Command Injection via Runtime Execution > Flag use of `Runtime.exec()` or `ProcessBuilder` with unsanitized user inputs. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Insecure Deserialization > Flag uses of `ObjectInputStream.readObject()` on untrusted input sources. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unvalidated Input in Controllers > Flag missing validation annotations (`@Valid`, `@NotNull`, etc.) on `@RequestBody`, `@PathVariable`, or `@RequestParam` parameters. > ``` > [accordion] Express.js > > ```mdx theme={"theme":"css-variables"} > ## Missing Error Handling in Async Routes > Flag `async` route handlers without `try/catch` or a wrapper to forward errors to `next()`, which can cause unhandled promise rejections. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unvalidated `req.body` and `req.params` > Flag any use of user inputs directly (e.g., `User.find(req.params.id)`) without schema validation via Joi, express-validator, or similar. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Use of `eval()` or `Function()` Constructors > Flag any `eval()` calls or dynamic function creation from user inputs, as they enable arbitrary code execution. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Insecure Cookie Configuration > Flag cookies set without `HttpOnly`, `Secure`, or proper `SameSite` attributes in `res.cookie()` calls. > ``` > [accordion] Laravel > > ```mdx theme={"theme":"css-variables"} > ## Mass Assignment without `$fillable` or `$guarded` > Flag `Model::create($request->all())` when the model doesn’t declare safe `$fillable` fields. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Raw Queries without Bindings > Flag `DB::select("SELECT … WHERE id = $id")` - use parameter binding (`?` or named bindings) or Eloquent methods to avoid SQL injection. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Missing CSRF Protection > Flag forms or AJAX routes lacking `@csrf` in Blade templates or `$request->validate()` in controllers. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Committed `.env` with Secrets > Flag any project commits that include the `.env` file containing database credentials or API keys. > ``` > [accordion] Ruby on Rails > > ```mdx theme={"theme":"css-variables"} > ## Mass Assignment via `params` without Strong Parameters > Flag controllers using `Model.create(params[:model])` without whitelisting via `params.require(:model).permit(...)`. > ``` > > ```mdx theme={"theme":"css-variables"} > ## N+1 Query Patterns > Flag view or controller code like `@users.each { |u| u.posts.count }` instead of eager loading with `includes(:posts)`. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Skipping Model Validations > Flag calls to `save(validate: false)` or `update_column` that bypass ActiveRecord validations. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unhandled Exceptions in Callbacks > Flag `after_save` or `before_destroy` callbacks without error handling, which can break request flows. > ``` > [accordion] ASP .NET Core > > ```mdx theme={"theme":"css-variables"} > ## Dynamic SQL via String Interpolation > Flag any `context.Database.ExecuteSqlRaw($"…{userInput}…")` or concatenated SQL strings - instead use parameterized queries. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Missing Anti-Forgery Token Validation > Flag POST actions without `[ValidateAntiForgeryToken]` when using Razor Pages or MVC forms. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Exposing Sensitive Data in ViewBag/ViewData > Flag passing secrets or tokens through `ViewBag` or `ViewData` for use in Razor views. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Improper CORS Configuration > Flag overly permissive CORS policies in `AddCors` (e.g., `AllowAnyOrigin`) that expose APIs unintentionally. > ``` > [accordion] PySpark > > ```mdx theme={"theme":"css-variables"} > ## Calling `collect()` on Large RDDs/DataFrames > Flag any `df.collect()` or `rdd.collect()` on datasets >100K records, which can OOM the driver - use `take()` or write to storage instead. > ``` > > ```mdx theme={"theme":"css-variables"} > ## User-Defined Functions (UDFs) over Built-ins > Flag use of `udf(myFunc)` for simple operations that Spark already optimizes (e.g., string, date functions) - opt for Spark SQL functions. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Joins without Broadcast for Small Tables > Flag large DataFrame `.join(smallDf, on, "left")` without using `broadcast(smallDf)`, leading to skewed shuffles. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Caching Too Early or Too Much > Flag `.cache()` on DataFrames before pruning unnecessary columns or filtering, which wastes executor memory. > ``` > [accordion] Meteor > > ```mdx theme={"theme":"css-variables"} > ## Overusing `autopublish` Package > Flag projects where `autopublish` is not removed, exposing all collections to the client by default. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Insecure `allow/deny` Rules > Flag any `Collection.allow({ ... })` or `deny` settings permitting broad inserts/updates without checking `this.userId` or document ownership. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Publishing Excessive Fields > Flag publications that return whole documents (e.g., `return Collection.find()`) instead of selective fields to minimize data exposure. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Unchecked Meteor Method Inputs > Flag Meteor methods that access `this.userId` but do not validate or sanitize the `args` object, inviting injection attacks. > ``` > [accordion] Svelte > > ```mdx theme={"theme":"css-variables"} > ## Direct DOM API Usage > Flag any `document.querySelector`, `addEventListener`, or manual DOM updates inside components - instead use Svelte’s reactive bindings. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Mutable Store Updates without `update()` > Flag direct assignments to store values (e.g., `myStore.set = …`) rather than using `myStore.update(...)`, which can break reactivity. > ``` > > ```mdx theme={"theme":"css-variables"} > ## Heavy Computation in Markup > Flag long-running loops or calculations in the template (e.g., `{#each bigArray.map(...) as item}`) - move logic into a `