Superpowers for engineering
The three runs that read a codebase or ship a page.
The steps
- Which of these you want — The two audits are read-only by contract: they open no pull request, change nothing, and put no working exploit in the report. That is what makes them safe to point at a repository you do not fully trust. The landing page run is the exception on this shelf — it builds, and it deploys if Cloudflare is connected.
- Audit a codebase — Use it when you have a codebase you did not write, or one you can no longer evaluate yourself.
**You get** — the architecture as it is rather than as the README claims, debt located where it costs — the files that change most and are hardest to change — and quick wins ranked by payoff over effort.
**Stays yours** — the work. It is read-only and opens no pull request.
Run by the **CTO** · ~14 min · needs GitHub.
- Audit security and dependencies — Use it when you are about to expose something publicly, or something just gave you a scare.
**You get** — secrets in the code and in the history, dependencies with the vulnerable path checked for reachability, risky patterns and auth — rated by real exposure rather than by CVSS, each finding stated as what an attacker can concretely do.
**Stays yours** — patching. It exploits nothing and puts no working exploit in the report.
Run by the **CTO** · ~12 min · needs GitHub.
- Build and ship a landing page — Use it when a page has to exist this week and design is not the bottleneck you want.
**You get** — the argument written before the page, one action repeated rather than four competing buttons, mobile-first — deployed live if Cloudflare is connected, delivered as files with deploy instructions if not.
**Stays yours** — the domain, and the traffic.
Run by the **CTO** · ~12 min · sharper with Cloudflare.
- Triage every production alert — Use it when your monitoring fires into a channel nobody reads, and the alert that actually mattered last month was four screens above the noise.
**You get** — a webhook URL to point your Sentry alert rule at. Every alert that hits it is checked against a ledger of what you have already triaged, measured for who it breaks, rated against your own definition of critical, ranked by likely cause, and written to one file in shared/incidents/ — with a direct message only when it crosses the line you drew.
**Stays yours** — that line, and everything it may never do. It reads, rates and writes; it deploys nothing, restarts nothing and closes no alert, and the guardrails you write at setup are the only ones it has.
Run by the **CTO** · ~2 min · sharper with Sentry, GitHub, Linear or Jira.
- Review every merged pull request — Use it when code ships faster than anyone reviews it, and the changelog is written from memory at release time.
**You get** — every merge read for what actually changed and what could break, judged strictly on the parts you named as fragile and lightly everywhere else, with the changelog line already written.
**Stays yours** — acting on it. It writes to a file and interrupts you only for what you said was worth interrupting for.
Run by the **CTO** · ~2 min · sharper with GitHub, Linear or Jira.
You should see
You can name the one run that produces the thing you were about to make by hand.
The OpenLabor Academy