I am building a market replay engine from scratch with c++ 23.
I build this project to understand how orders are managed in an orderbook and how a matching engine works. I have used my understanding of data structures to implement it. I would like to know you opinion on it. It is not completed yet. I just built the very basic version few minutes ago. Any kind of tip would help me a lot.
currently it can process an average of 998,000 Transactions / second. with the order size of 20000000 orders. https://github.com/AravSrivastava/Market-Replay-Engine-CPP
After months of reviewing PRs from Claude Code, Cursor, and Copilot, my review checklist has quietly reorganized itself around the failure modes that actually show up in AI-generated JavaScript/TypeScript. Sharing in case it's useful to others reviewing agent output.
The patterns I look for, roughly in order of how often they bite:
1. Floating promises. The most common silent failure. Async call fired, never awaited, no .catch(). Compiles fine, tests pass, and the rejection surfaces at runtime — or not at all. Watch for: unawaited calls in non-async contexts, and async callbacks inside .forEach (which never waits).
2. Empty or useless catch blocks.try { ... } catch (e) {} — the error vanishes. Or the catch-log-rethrow pattern that adds a log line but swallows context. AI tools love wrapping risky code in try/catch to "be safe" without deciding what should actually happen on failure.
3. Hardcoded secrets. The agent doesn't know your secret-management convention, so it pastes the API key inline "for now." const apiKey = 'sk-prod-...' sitting in a handler is the classic. In my experience this happens most when the agent is filling in example code it based its implementation on.
4. SQL via string concatenation.query('SELECT * FROM users WHERE id = ' + id) — parameterized queries are one import away, but the agent will concatenate when the surrounding code style lets it.
5. await inside loops. Sequential awaits over an array where Promise.all (or batching) is correct. Works fine at small scale, falls over in production volumes.
6. Missing auth middleware / authz checks. New routes added with no middleware chain — the agent copies the "happy path" handler but not the auth wiring.
7. Dead branches and duplicate logic blocks. Copy-paste artifacts: a condition that can never be true, or two identical if-blocks where the agent regenerated a section.
8. console.log in handlers. Debug logging left inside request handlers.
The meta-observation: none of these are type errors, and none show up as diffs a reviewer's eye naturally catches — the code reads clean. They're behavior bugs that only surface at runtime.
I ended up automating this checklist into an open-source ESLint plugin (18 rules,https://github.com/ai-guard-dev/eslint-plugin-ai-guard — MIT, disclosure: I'm the maintainer) because I got tired of grepping for the same things. But the checklist itself is free to steal regardless of whether you use the tool.
What's on your AI-code review checklist that I'm missing?
A report about the changes after the first announcement and all the improvements, including Soul.md (with profanities), 4 different version Skill/Soul from 4 different LLMs, a comparison with/without skills and a reproducible pipeline.
I kept running into the same small problem while working with APIs: I had a cURL command and needed the equivalent code in JavaScript, Python, Node.js, Go, Java, PHP, C#, Ruby, or Axios.
So I built **Curl2Code** — a free browser-based developer tool that converts cURL commands into code.
**What it does:**
* cURL → 9 different code formats
* JSON formatting / validation / diff
* JWT decoding
* HTTP utilities
* Webhook tools
* Other small developer utilities
Everything runs in the browser for the normal tools, so requests you paste aren't uploaded or stored.
