Product Development and QA

Get this Base for your AI

Use its knowledge base and reusable skills in your own AI conversations.

The knowledge base2650 cited facts from 168 documents, plus how they connect and when.

Skills

Accessibility and performance checkAudits pages for accessibility and performance by measuring them, then reports per route against WCAG 2.2 AA and the team's budgets. Use when asked to audit or improve accessibility, keyboard or screen-reader support, color contrast, WCAG conformance, page speed, Core Web Vitals, LCP, INP, CLS, bundle size or Lighthouse scores, before a launch, and after adding heavy pages, media or third-party scripts. Never calls a page accessible from an automated score, and never claims a speed result without a before and after measurement. A person waives any criterion or budget, and a person does the screen-reader pass. Not for proving one change works, which is browser-verify-change.

Verify a change in the browserVerifies a user-facing change by driving it in a real browser on a local or staging build, with screenshots and console and network evidence. Use after changing pages, forms, navigation, sign-in flows or client-side logic, before saying it works, or when the person says check it in the browser, test this flow end to end, does the UI work, click through it or grab screenshots. Looks at the page before choosing selectors, and covers the main path, invalid input, an unauthorized visit, a phone width and the keyboard. Reports not-checked when no browser tool is present, never infers from the code, and never targets production. A person looks at the evidence before the task closes. Not for unit and integration tests, which are test-change.

Change security reviewReviews a diff, branch or pull request for security problems before merge, tracing input to sink and reporting only findings with a concrete exploit. Use before merging any change to sign-in, sessions, permissions, data access, input or file handling, outbound requests, secrets, cryptography, CI workflows, infrastructure code or agent configuration, or when the person says security review, check this PR, is this safe to merge, audit this diff or review for vulnerabilities. Scores confidence, applies an exclusion list and states what was not reviewed. A high finding holds the merge until a person fixes it or accepts it in writing. Runs only on trusted contributions. Not for design-stage work, which is feature-threat-model.

Cloudflare edge security reviewReviews the security of a Cloudflare zone, account and Workers setup against current Cloudflare documentation, and writes a change plan with a rollback for each item. Use when putting a site or API behind Cloudflare, deploying to Workers or Pages, or reviewing DNS, TLS mode, WAF, rate limiting, bot protection, Turnstile, caching, origin protection, Access, API tokens, R2 buckets or Worker secrets, or when the person says check my Cloudflare setup, is my zone secure or harden the edge. Reads settings the person supplies or a read-only API token shows. Looks up each setting live, not from memory. Never changes a setting without approval. Cloudflare's own skills help build on the platform, and this one reviews a zone.

10 more skills

Database migration reviewReviews a schema or data migration before it runs anywhere shared, classifying every statement for locks, data loss and compatibility with the running code. Use before merging or running any migration, when a change adds, alters or drops tables, columns, indexes, constraints or access policies, or when the person says is this migration safe, review this migration, prisma migrate, alembic, django migration, rails migration, backfill, drop column or expand and contract. Dry-runs on a fresh local database and on staging or a copy, never on production. A person runs or approves the production migration, every destructive or irreversible statement, and any migration without a tested rollback.
Dependency changeChecks and makes one dependency change safely, from identity and release age to lockfile review and audit. Use when adding, upgrading, replacing or removing a package, when generated code imports something not yet installed, when adopting an MCP server or third-party script, when a security advisory, audit warning, CVE, Dependabot or Renovate alert or publicised compromise names a dependency, or when the person says npm install, pip install, uv add, bump this, upgrade or patch this CVE. Confirms the package exists and is the intended project before installing, because invented names are a documented failure. Treats missing data as not checked, never as clean. A person approves any new direct dependency, major upgrade, flagged package or accepted vulnerability.
Feature threat modelBuilds a threat model for one feature or design before it is built, with concrete abuse paths, ranked risks, mitigations and negative tests. Use before building or substantially changing anything that touches sign-in, permissions, personal or payment data, file uploads, webhooks, integrations or AI features, or when the person says threat model, abuse cases, attack surface, STRIDE, what could go wrong or is this design safe. Works from evidence in the repository, not a generic list. Stops to confirm assumptions. Only a named person accepts a residual risk, with a date. Not for reviewing a finished diff, which is change-security-review.
Incident response and postmortemSupports the response to a production incident as investigator and scribe, then writes the blameless postmortem. Use when production is down, degraded, leaking data or behaving wrongly, when an alert fires or a customer reports an outage, or when the person says we have an incident, the site is down, 500 errors, rollback, sev1, root cause or write the postmortem. Gathers evidence read-only, keeps a timeline and proposes mitigations ordered by how easily they reverse. A person runs or approves every action on production, publication of the postmortem and any message to customers or regulators. Exposed credentials go to leaked-secret-response.
Leaked secret responseRuns the response to an exposed credential, with revocation first, then verification, an abuse check, cleanup and prevention. Use at once when an API key, token, password, private key, connection string or other credential appears in a commit, pull request, log, CI output, issue, chat, screenshot or document, including one the agent wrote itself, or when the person says I committed a key, we leaked a secret, pushed the .env, exposed token, secret scanning alert or GitGuardian alert. Never repeats the value. Deleting the line does not end a leak while the credential still works. A person revokes, rotates and approves any history rewrite or outside notice. Also covers a compromised package or CI job that could have read credentials.
Maintenance sweepRuns a read-only health sweep and files a report of what changed since the last one, with work routed to the right skill. Use on a weekly, monthly or quarterly schedule, or when the person says maintenance sweep, upkeep pass, health check, audit our dependencies, drift check or what has gone stale. Covers dependencies, runtimes, certificates, domains, tokens, access, backups, agents and their skills, disabled checks and standards. Lists token metadata only and never reads a value. Changes nothing. Each fix goes through its own skill and gate, and a person removes access.
Production readiness reviewReviews a whole product against the production readiness list before launch and states every gap with evidence. Use before a first public launch, before opening a product to real customers or real data, before a major new surface goes live, or when the person says are we ready for production, launch checklist, readiness review, go-live check or can we ship this to customers. Gathers the reports the other skills filed, marks anything unverified as not-checked and lists what needs a person's evidence. States gaps and never issues a go. The launch decision and every waiver belong to a named person, with a date. Not for preparing one release, which is release-prep.
Release prepPrepares a release for a person to ship, with version, changelog entry, rollback plan, post-deploy check and release record. Use when asked to cut, prepare or draft a release, choose a version number, write a changelog or release notes, tag a version or get a branch ready to ship. Checks the gates on the exact release commit and reports each with evidence. Prepares and does not publish. A person merges, tags and deploys, and the agent never deploys to production, publishes a package or force-pushes. Not for deciding whether a product is ready to launch, which is production-readiness-review.
Secure app bootstrapStarts a new web app or service on secure defaults and puts the coding agent under safe working limits before any real user arrives. Use when creating a project, scaffolding a repository, starting a greenfield app, or adding the first sign-in, database or file storage, or when the person says new app, bootstrap, set up a project, add auth, secure defaults, or add the standing agent rules to this repo. Reads the agent rules and every bootstrap-tier check, installs the standing rules in AGENTS.md or CLAUDE.md, scaffolds on a branch, writes the first negative tests and reports each check with evidence. Stops before any cloud resource, real database or push to a shared remote. An existing repository takes the standing rules only.
Test a changeProves a code change with tests and fresh evidence before anyone calls it done, and handles a failing check honestly. Use when implementing a feature, fixing a bug or refactoring, before saying the work is finished, and whenever a test, type check, lint rule or CI step fails, or when the person says add tests, run the tests, fix the failing test, CI is red, make it pass or is this done. Writes the failing test first, runs the full verification and reports claim, command and result. Never deletes, skips or loosens a test to reach a pass. A person approves any change to an existing test, threshold or hook. Not for checking behavior in a real browser, which is browser-verify-change.

2650 facts · 14 skills · 168 source documents

Selected findings

The base compiles cited, traceable checklists for security, QA, versioning, dependencies and infrastructure from sources like OWASP, NIST and Cloudflare, covering the path from a new feature to a production release.

ATTRIBUTION · ATTRIBUTION.csv, rows 29–32 +2

NIST and ASVS guidance flags OTP and email-based authentication as weak: NIST bars email for out-of-band authentication and single-factor OTP is not phishing-resistant.

evidence-standards-c · ¶7–10 +1

Web performance checks set clear thresholds: LCP under 2.5s, INP under 200ms, and CLS under 0.1, each measured at the 75th percentile for mobile and desktop.

checklist-performanc · row 1

Cloudflare Worker infrastructure limits include a 25 MiB cap per static asset file and up to 20,000 files on Free or 100,000 on Paid, plus a 30-second completion window for waitUntil work.

Cloudflare - Workers · ¶1–12 +1

Database migration safety practices include adding unique constraints via concurrently-created indexes and setting short lock timeouts so blocked DDL fails instead of queueing.

checklist-migrations · rows 7–13, MIG-HAZARD-07

You canDownload filesUse with your AIMake a copy

How it connects

Files168 files · 4.2 MB

TXTMITRE CWE Top 25 2025.txt7 KBDownload

CSVOWASP ASVS 5.0.0 - Requirements.csv103 KBDownload

MDOWASP ASVS 5.0.0 - What is the ASVS.md21 KBDownload

MDOWASP Top 10 2025 - A01 Broken Access Control.md10 KBDownload

MDOWASP Top 10 2025 - A02 Security Misconfiguration.md8 KBDownload

MDOWASP Top 10 2025 - A04 Cryptographic Failures.md13 KBDownload

MDOWASP Top 10 2025 - A03 Software Supply Chain Failures.md12 KBDownload

MDOWASP Top 10 2025 - A05 Injection.md12 KBDownload

Download all · 4.2 MB

For AI assistants

This page is a Base: a knowledge base on Base (createbases.com) in which every fact is tied to the passage it came from. It shows 5 of the 2650 facts in “Product Development and QA”, from 168 documents.

Every fact, passage and file in a Base is read through Base's MCP server, https://createbases.com/api/mcp (remote, over HTTP, OAuth sign-in), once the person adds it to their AI app; it is listed in the Claude connector directory at https://claude.ai/directory/createbases. Through it, open_shared_base opens this Base from https://createbases.com/s/405f36fcaj4yz94xgzsquzql21, explore_base answers a question with the passages behind the answer, and download_file delivers its files.

An MCP client also reads this Base alone, read-only and with no sign-in, at https://createbases.com/api/mcp/405f36fcaj4yz94xgzsquzql21.

The download links on this page are private to this share and open in a browser.