AI Prompts Library

Build me a model evaluation set from real work instead of a public benchmark.

Given the closed issues and their merged fixes below, produce 20 eval tasks. For each:

1. TASK: the issue restated as a self-contained instruction, with no hints about the actual fix
2. CONTEXT NEEDED: which files a model would have to read to solve it
3. PASS CRITERIA: an objective check, ideally a test command, that distinguishes a real fix from a plausible one
4. DIFFICULTY: trivial / moderate / hard
5. TRAP: what a model is most likely to get subtly wrong here

Exclude issues that are pure dependency bumps, typo fixes, or anything where the fix is stated in the issue title.

Issues and fixes:
[PASTE]

You are a principal software engineer conducting a thorough code review. You combine deep security expertise with performance engineering knowledge. Review the submitted code with extreme attention to detail.

**Code to Review:**
[PASTE CODE HERE]

**Language/Framework:** [SPECIFY]
**Context:** [WHAT DOES THIS CODE DO AND WHERE DOES IT RUN]

**Review Checklist:**

**Security Analysis (CRITICAL):**
- [ ] SQL Injection: Are all queries parameterized? Any string concatenation in queries?
- [ ] XSS: Is user input sanitized before rendering? Are Content-Security-Policy headers set?
- [ ] CSRF: Are state-changing requests protected with tokens?
- [ ] Authentication: Are passwords hashed with bcrypt/argon2? Are JWTs validated properly?
- [ ] Authorization: Is there proper access control on every endpoint? IDOR vulnerabilities?
- [ ] Input Validation: Are all inputs validated for type, length, format, and range?
- [ ] Secrets: Are API keys, passwords, or tokens hardcoded? Are they in environment variables?
- [ ] Dependencies: Are there known CVEs in the dependency versions used?
- [ ] File Upload: Are file types validated server-side? Is the upload directory outside webroot?
- [ ] Rate Limiting: Are sensitive endpoints rate-limited?

**Performance Analysis:**
- [ ] N+1 Queries: Are there database queries inside loops?
- [ ] Missing Indexes: Are queried columns properly indexed?
- [ ] Memory Leaks: Are event listeners, subscriptions, or intervals cleaned up?
- [ ] Unnecessary Re-renders: Are React components memoized appropriately?
- [ ] Bundle Size: Are large libraries imported when smaller alternatives exist?
- [ ] Caching: Are expensive computations or API calls cached appropriately?
- [ ] Async Operations: Are promises handled correctly? Any unhandled rejections?
- [ ] Algorithm Complexity: Are there O(n^2) or worse operations that could be optimized?

**Code Quality:**
- [ ] Single Responsibility: Does each function/class do one thing well?
- [ ] DRY: Is there duplicated logic that should be extracted?
- [ ] Error Handling: Are errors caught, logged, and handled gracefully?
- [ ] Naming: Are variables and functions named clearly and consistently?
- [ ] Comments: Are complex algorithms explained? Are TODO/FIXME items addressed?

For each finding, provide: Severity (P0-P3), location, explanation, and a concrete fix with code.