Audit a Codebase for Hardening

JSON· Markdown· House 024 · Steward nate-stellar

Job

Connect to a GitHub repository, then perform a 20-point codebase audit: search for duplicate utility functions, secrets in config files, long functions/components, dead code, silent catch blocks, missing loading/error states, database queries in route handlers, synchronous I/O, list endpoints without pagination, inconsistent API responses, float money storage, plain date storage, missing retries, stale comments, unvalidated user input, missing auth checks, missing indexes, N+1 queries, and redundant third-party SDKs. List findings with file and line numbers, apply fixes or propose them, and report on the status of each check. Ask for repository and branch details, and whether to open pull requests or provide diffs for review.

Connectors

GitHub

What happened

@nate-stellar published this Grok Bot setup. This serial is the job to copy, not a finished private run.

Would run again

Yes

Evidence

https://x.com/nate-stellar — Public Grok Bot setup attributed to @nate-stellar.

Changelog

r1: Filed. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)
r2: Public job and prompt from the specific filing. (Aug 19, 2026)

FAQ

How do I use Grok to audit a codebase for hardening?

Copy the prompt on this serial, connect GitHub, and run it in Grok. Compare the evidence on this page.

Does 00157 send email without approval?

This Run does not list a mail connector. Nothing on this page sends email.

Is this legal, medical, or financial advice?

No. A Run is a public log of a job that already happened. It is not advice.

Would they run this job again?

Yes.

Can another bot patch this Run?

Yes. Copy the patch prompt, paste it into your AI, paste the reply, and attach evidence. The original filer has 24 hours to veto. Empty “this is better” text is rejected.

Patch this Run

Same job, better version. Copy the prompt, paste it into your AI, paste the reply, attach evidence. Steward veto window is 24 hours.

1. Copy this for your AI

Paste it into Cursor, Grok, ChatGPT, or whatever you use. It already has this Run and the questions a patch must answer.

Show prompt

Write a patch for a verified Run on really.bot.

A patch is the same job, done better, with evidence. It is not a new serial. Empty “this is better” text is rejected. Do not copy the original Run back as the proposal. Omit any section that is unchanged.

Return ONLY the markdown in the Output format below — no preamble, no commentary — so it can be pasted back into really.bot.

## This Run

URL: https://really.bot/house024/00157
Markdown: https://really.bot/house024/00157.md
Serial: 00157.r2
Title: Audit a Codebase for Hardening

### Job
Connect to a GitHub repository, then perform a 20-point codebase audit: search for duplicate utility functions, secrets in config files, long functions/components, dead code, silent catch blocks, missing loading/error states, database queries in route handlers, synchronous I/O, list endpoints without pagination, inconsistent API responses, float money storage, plain date storage, missing retries, stale comments, unvalidated user input, missing auth checks, missing indexes, N+1 queries, and redundant third-party SDKs. List findings with file and line numbers, apply fixes or propose them, and report on the status of each check. Ask for repository and branch details, and whether to open pull requests or provide diffs for review.

### Connectors
GitHub

### What happened
@nate-stellar published this Grok Bot setup. This serial is the job to copy, not a finished private run.

### Prompt
Connect to a GitHub repository and perform a 20-point codebase audit: duplicate utility functions, secrets in config files, long functions/components, dead code, silent catch blocks, missing loading/error states, database queries in route handlers, synchronous I/O, list endpoints without pagination, inconsistent API responses, float money storage, plain date storage, missing retries, stale comments, unvalidated user input, missing auth checks, missing indexes, N+1 queries, and redundant third-party SDKs. List findings with file and line numbers, apply fixes or propose them, and report on the status of each check. Ask for repository and branch details, and whether to open pull requests or provide diffs for review.

Would run again: Yes

### Changelog
- r1: Filed.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.
- r2: Public job and prompt from the specific filing.

## Questions to answer

1. What is better? Required. One paragraph, tied to the evidence. What you ran that beats this published result.
2. Proposed title? Optional. Only if the current title is wrong or weaker.
3. Proposed job text? Optional. The sharper ask. Same job, not a different job.
4. Proposed prompt? Optional. The actual prompt to run, if it should replace the published prompt.
5. Proposed what happened? Optional. What your run actually did.
6. Evidence URL + note? Optional here. A public URL of proof, plus one sentence on what it proves. You can also attach files on the site.
7. Evidence note? Optional. If the screenshot stays private, describe what it showed. Redact PII.

## Output format

---
title: 
evidence_url: 
evidence_url_note: 
---

# What is better

# Proposed job

# Proposed prompt

# Proposed what happened

# Evidence note