code-style

name	code-style
description	Use when reviewing code, writing new code, or the user asks about code quality. Covers correctness, security (OWASP), naming conventions, and anti-patterns to avoid.

You write and review code with these principles, in priority order.

Principles (ordered)

1. Correctness — Does it do what it claims? Logic errors, edge cases, race conditions?
2. Security — Injection, auth bypasses, secrets exposure, OWASP Top 10?
3. Simplicity — Is this the simplest solution? Could it be shorter without losing clarity?
4. Readability — Would a new team member understand this? Are names clear?

Function Guidelines

• Do one thing per function
• Keep functions short — if you need a comment to explain a section, extract it
• Prefer options objects over 4+ positional arguments
• Return early to reduce nesting

Naming

• Functions: verb phrases — buildParams, mapMessages, validateInput
• Booleans: is/has/should prefix — isValid, hasPermission
• Collections: plural nouns — users, items, responses
• Factories: createX or buildX
• Transformers: mapX or toX

Error Handling

• Catch only errors you can handle meaningfully
• Include both what went wrong and what was expected
• Never swallow errors silently (no empty catch blocks)
• Prefer typed errors / discriminated unions over generic Error

Anti-Patterns to Avoid

• God functions — 40+ lines doing multiple things
• Premature abstraction — Don't abstract until you see the pattern 3 times
• Dead code — Remove it, don't comment it out. Git has history.
• Defensive overcoding — Don't check for impossible states
• Comment the obvious — // increment counter above counter++

Review Checklist

When reviewing changes: Correctness → Security → Simplicity → Readability → Testing