Swipe right for a newer agent, Boss Prep Sheet. Swipe left for an older agent.
Issue 01 · 5 Sep 2026 · Medium · Free
Diff Risk Reviewer
The model wrote a change that looks finished, and you cannot tell which behavior moved just by scrolling the green lines.
Read a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.
- Category
- Coding & Vibe Coding
- Runs in
- Cursor
- Claude
- ChatGPT
What you put in and what you get out
Sample you can paste
diff --git a/app/api/orders/route.ts b/app/api/orders/route.ts
@@
- const total = cart.items.reduce((sum, item) => sum + item.price * item.qty, 0);
- if (total <= 0) return Response.json({ error: "empty" }, { status: 400 });
+ const total = Number(body.total);
+ await db.order.create({ data: { userId: body.userId, total, status: "paid" } });
+ return Response.json({ ok: true, total });Share this agent
Diff Risk Reviewer — You put in diff --git a/app/api/orders/route.ts b/app/api/orders/route.ts. You get out The check. Free from One Agent a Day.
30-second demo
0:00
The intended change
One sentence: checkout should trust the price the server already computed.
How it works
This review is about behavior, not style. You give it a unified diff and one sentence about what the change was supposed to do. It quotes the hunks that change an outcome a user or a caller would notice, and it skips drive-by formatting.
It will not invent a vulnerability class, a CVE, or a line that is not in the diff. If the risky part is "the client now chooses the number," it says that and names the check that would have caught it. Exploit steps belong to the security checker, which refuses them. This agent stops at impact and a test you can run.
Paste the smallest diff that still shows the behavior. A thousand-line lockfile will bury the point. If the model summarizes a file it cannot quote, reply: quote the hunk or drop it.
Use it
Step 1
Copy the diff, not the whole repo
From your editor or git, copy the unified diff for the change you are about to push. Keep it under a few hundred lines. If it is larger, review one file at a time.
Step 2
Paste the prompt, then the diff
Start a new chat. Paste the prompt first so the output format sticks, then paste the diff. Say what the change was supposed to do in one sentence.
Step 3
Read findings before you edit
Treat each finding as a question about behavior. If the model cannot quote a hunk, delete that finding. Do not apply a rewrite you do not understand.
Step 4
Run the check it names
The review ends with one command or one manual check. Run that before you push. Security exploits are out of scope; use the security checker for those.
Prompt
diff-risk-reviewer.prompt.txt
You are the Diff Risk Reviewer. You read a unified diff the author is about to push. You report behavior risk. You do not restyle the code and you do not write exploit steps.
INPUTS
- Diff: a unified diff, or a before/after pair clearly labeled.
- Intent: one sentence from the author about what the change was supposed to do. If it is missing, infer nothing; ask for it and stop.
RULES
- Quote the hunk for every finding. A finding without a quote is not a finding.
- Describe impact a user, caller, or later reader would notice: data written, money, permissions, empty states, deleted branches.
- Do not invent functions, files, or metrics that are not in the diff.
- Do not provide exploit steps, payloads, or bypasses. Name the impact and the check.
- If the diff is only formatting, dependencies with no code change, or a rename, say so and stop after the summary.
- Prefer the smallest check that would fail on the old behavior and pass on the intended behavior.
- Cap the review at 5 findings. Put the one that would make you revert first.
OUTPUT
## What changed
2 sentences. Tie them to the author's intent. If the intent was missing you already stopped.
## Findings
For each:
- Quote: the relevant hunk, trimmed
- What a caller notices
- Check: a test name or a manual step, not an exploit
## Push
One line: push, push after the check, or do not push until the first finding is fixed.
## Assumed
Bullets. If none, write "None."Related agents
Swipe sideways
Coding & Vibe Coding15 Oct 2026 · #41Session HandoffPaste the mess from a coding session. Get a handoff note: what shipped, what is broken, and the exact prompt to paste tomorrow.InBranch: feat/billing-uiOutTomorrow's first promptEasy Preview this drop
- 0:00 The swampBranch feat/billing-ui. Auth works. Billing page half done. Stripe webhook returns 400. Receipt email never fires.
- 0:08 What actually shippedLogin on staging, pricing table render, stripe package installed. Plan change is still a stub. PayPal left alone on purpose.
- 0:16 What is brokenWebhook 400, missing signature check, BillingForm customerId null, receipt email not wired. Ranked by what blocks the rest.
- 0:24 Tomorrow's first promptA paste-ready prompt that starts at the webhook 400, forbids touching PayPal, and asks for a signature check plus a failing test.
No daily video for this drop yet. The in and out lines above are the preview.
Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.OutWhat it will not doMedium Preview this drop
- 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
- 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
- 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
- 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.
No daily video for this drop yet. The in and out lines above are the preview.
Coding & Vibe Coding29 Sep 2026 · #25Env Var AuditorPaste .env.example and the code that reads it. Get missing keys, unused keys, and names that look like live secrets.In.env.exampleOutThe fixMedium Preview this drop
- 0:00 The driftPORT and DATABASE_URL are read. DATABASE_URL is required. FLY_REGION is read and missing from the example.
- 0:08 UnusedNothing in the example is unread. FLY_REGION is the gap, the other way.
- 0:16 The live-looking valueSTRIPE_SECRET_KEY's example starts with sk_live_. That prefix does not belong in an example even if they say it is fake.
- 0:24 The fixAdd FLY_REGION=local. Change the Stripe example to a sk_test_ placeholder. Do not print a real key.
No daily video for this drop yet. The in and out lines above are the preview.
Tomorrow's drop
Get tomorrow's agent in your inbox
One email when the drop goes up. No digest, no course. Unsubscribe whenever the provider lets you.
Pro and custom
€9/month when Pro opens
Early look at the next drop, a better archive, and the occasional agent that does not fit the public mix. The daily agent stays free. A custom build is €49–199. Nothing is charged from this form.
Join the Pro waitlist