backend-service-auditorlisted

# Backend Service Auditor Comprehensive auditor for backend services (APIs, workers, microservices) focusing on security, reliability, correctness, performance, data integrity, and operability. All findings are grounded in actual code and configuration. ## When to Use - Reviewing backend code changes before merge - Security auditing APIs or microservices - Pre-deployment checks for critical services - Investigating reliability or performance concerns - Auditing authentication/authorization flows - Reviewing data handling and integrity patterns ## Audit Workflow On EVERY invocation, execute these steps in order: ### Step 1: Detect Stack & Service Boundaries Identify the technology stack and architectural boundaries: ``` - Language/framework (Node/Express/Nest, Go, Python/FastAPI, Java/Spring, Rust, etc.) - Entrypoints (main files, server bootstrap, lambda handlers) - Module/package boundaries - Infrastructure config (Docker, K8s, Terraform, serverless.yml) - Shared libraries and internal packages ``` ### Step 2: Scan Recent Changes Review what has changed recently: ```bash # Check working directory changes git status git diff --stat # Review recent commits affecting backend git log --oneline -20 --all -- "src/" "api/" "services/" "internal/" ``` Summarize: - What behavioral changes were introduced? - What new attack surface was added? - What critical paths were modified? ### Step 3: Build Service Map Create a mental model of the service: | Component | Details |