Development

Surgical code refactoring to improve maintainability without changing behavior. Covers extracting functions, renaming variables, breaking down god functions, improving type safety, eliminating code smells, and applying design patterns. Less drastic than repo-rebuilder; use for gradual improvements.

Redis production hardening — authentication (requirepass/ACL users), TLS, least-privilege ACLs, network restriction (bind, protected-mode, firewall), and disabling dangerous commands. Use when deploying, locking down, or auditing a Redis instance.

Redis Query Engine (RQE) — FT.CREATE schema design, field-type choice, DIALECT 2 syntax, efficient FT.SEARCH/FT.AGGREGATE, zero-downtime index swaps. Use when creating, querying, or optimizing search indexes on Hash or JSON documents.

Core Redis modeling — choose the right data structure and consistent colon-separated key names. Use when designing a Redis data model, caching, building counters, leaderboards, or sessions, choosing Hash vs JSON, or reviewing key naming.

Guidelines for using React Query for data fetching, caching, and server state synchronization in React applications

React performance: unnecessary re-renders, memoization (React.memo/useMemo/useCallback), React Compiler, Context, concurrent features, code splitting, and Core Web Vitals.

React/Next.js best-practices reviewer for TSX/JSX. Triggers when writing or reviewing React components to check structure, hooks, accessibility, performance, and TypeScript patterns.

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

Professional React state-machine patterns. Use when implementing complex state logic, reducers, multi-step forms, async flows, or any component coordinating multiple states.

Prisma Postgres setup and operations — Console, create-db CLI, Management API, and the TypeScript SDK. Use when provisioning Prisma Postgres databases, linking a local project, or integrating programmatic provisioning with service tokens or OAuth.

Full API lifecycle via the Postman MCP Server — sync OpenAPI specs to collections, generate typed clients, run API tests, create mocks, publish docs, OWASP audits. Use for Postman, collections, specs, mocks, or SDKs.

Review SQL, schemas, and migrations for PostgreSQL best practices — JSONB, arrays, ENUMs/domains, PL/pgSQL, RLS, privileges. Use when reviewing any PostgreSQL DDL, query, function, or migration.

Write, debug, and maintain Playwright tests — flaky tests, Page Object Model, locators/waits, fixtures, network mocking, auth, CI/CD. Covers E2E, component, API, visual, a11y, and extension testing.

Review code and architectures against the OWASP Top 10:2025. Use to audit for vulnerabilities, guide remediation, or write secure code. Triggers: "security review", "OWASP audit", "check for vulnerabilities", "is this code secure".

Build production-ready Node.js backend services with Express/Fastify — middleware, error handling, auth, database integration, and API design. Use when creating Node.js servers, REST APIs, GraphQL backends, or microservices.

Next.js performance optimization for Core Web Vitals, image/font optimization, caching, streaming, bundle size, and Server Components. Use when fixing LCP/INP/CLS, implementing next/image or next/font, configuring unstable_cache, converting Client to Server Components, streaming with Suspense, or reducing bundle size. Covers Next.js 16 + React 19 patterns.

Next.js App Router principles. Server Components, data fetching, routing patterns.

NestJS best practices — 40 rules across modules, DI, error handling, security, performance, testing, database, API design, microservices, and deployment. Use when writing, reviewing, or refactoring NestJS code.

Create software diagrams in Mermaid — class, sequence, flowchart, ERD, C4, state, gitgraph, gantt. Use to "diagram", "visualize", "map out", or "show the flow" of architecture, database schemas, code structure, or user/app flows.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states

Hunting playbook for race-condition / TOCTOU vulnerabilities — concurrent-request abuse, HTTP/2 single-packet attacks, double-redeem / double-spend, MFA-OTP & email-verify races, rate-limit bypass. Use when hunting races or TOCTOU bugs.

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

Continuous fullstack delivery loop — cycles a combined frontend+backend team through test → diagnose → fix → review → secure → re-test, building both layers together in cross-side vertical-slice waves until every E2E/suite, code-quality, visual-fidelity, and security gate is clean. Use to develop, fix, harden, or finish a feature that spans the API and the UI in one coordinated loop, instead of running the frontend and backend loops back-to-back.

Front-end system-design reference — box model, rendering/reflow, DOM & Web APIs, virtualisation, state design, network transports, web performance.