cf-placeholder-404Retire a redirect on a Cloudflare zone and answer 404 instead on the free plan - a small module Worker on the apex and www routes, attached before the redirect rule is deleted so there is no 522 gap, then verified with curl. Use when a domain should stop redirecting and return not found, when parkin
cf-worker-binding-reviewReview a Cloudflare Workers project's bindings and configuration - service bindings instead of public URLs between workers, secrets as secrets not vars, environments that do not share production resources, compatibility date and flags, routes, observability and limits - before deploy. Use when revie
chrome-store-policy-reviewCheck a Chrome extension against the Chrome Web Store program policies before submission or after a rejection - single purpose, permissions justified one by one, user data disclosure and limited use, remote code, deceptive behaviour, and the listing itself - and map a rejection notice to the exact p
csp-live-verificationSet or tighten a Content-Security-Policy on a page behind a CDN that injects scripts, by loading the live page in a headless browser, collecting CSP violations and network requests, allowing only what the owner wants, hashing the site's own inline script from its source text, and re-loading to confi
dead-code-keep-or-retireDecide whether apparently unused code or a legacy service should be kept or retired, checking dynamic callers and external consumers and separating shutdown from permanent data disposal. Use when an unused-code report prompts removal, when stopping a legacy process or schedule, or when deciding what
existing-capability-before-buildMap a requested feature to existing implementation and actual wiring before planning a duplicate. Use when adding functionality, choosing reuse versus new code, or a missing UI or search result is taken as evidence that a capability does not exist. Not for validating a supplied code-review finding o
mcp-server-designDesign or review an MCP server's tools - few tools with clear names and descriptions written for the model, input schemas that reject bad calls, stable ids instead of positions, read-only and destructive annotations, paging and size limits, errors the model can act on, and auth that keeps credential
mv3-extension-reviewReview a Chrome Manifest V3 extension's architecture - a service worker that can be killed at any time, state that survives it, messaging between contexts, content scripts isolated from the page, permissions and host access kept minimal, and no remote code - before release. Use when building or revi
pg-migration-safetyReview a PostgreSQL schema migration for production safety - which statements take locks that block reads or writes, how long they hold them, CONCURRENTLY and NOT VALID patterns, backfills in batches, lock and statement timeouts, and the deploy order between code and schema. Use before running a mig
static-site-migration-parityMove a public static site to a new host or generator without breaking a URL - snapshot the live site path for path, build every URL form as a real file, compare a local container against the snapshot for status, media type and bytes, check renderer parity when the Markdown engine changes, and cut ov