Observe the world
Code review: here is some code with traps in it
The code is in the prompt — you do not bring your own. Each drill is a few dozen lines that look like they work, with about ten defects planted in order of severity. That list is the answer key. It stays quiet while you read, and only then tells you what you missed.
These prompts only exist in 简体中文 for now.
How to use this
The material is ours: a few dozen lines that look like working code, with about ten defects planted in order of severity. So this series needs nothing from you — open one and start.
The stance is interrogation: no spoilers, no praise, and being unable to answer is a normal outcome. Say "there is a race here" and it will not let it go — it wants two columns of timeline and the size of the damage.
How to start
- Pick one, open it, copy the prompt.
- Paste it into a fresh, empty chat; it will paste the code back to you as-is.
- Read it yourself and name every problem you find — in the first scene it will not interrupt or hint. Say "that is all" when you are done.
Four commands you can call out any time
跳过Move on to the next scene提示Give me a direction, not the answer直说吧Give the full answer for this point, then keep pressing on the cost复盘Jump straight to the wrap-up card
The wrap-up is a number
A find rate: how many you caught, out of how many, and how many were false alarms. Plus one uglier number — how many of the ones you missed are in the top severity band (loses money, leaks data, takes the service down). That number is worth more than the score.
Three traps
- The answer key at the end is that list of defects. Do not read it first — once you have, this drill is spent.
- Do not report naming or style. What counts here is whether money is lost or data leaks; style reports are recorded as false alarms.
- The moment it praises you, point it back at the "do not praise me" rule. Feeling validated drowns out "what did I miss".
Start with the transfer one — it has the densest set of defects. If you write API endpoints all day, go straight to the list endpoint: its broken access control and sort-parameter injection are the easiest to find a twin of in your own code. Whichever you do, go grep your own repo afterwards — the real output is those three take-away checks.