a prompt for ai for bug hunting

functional_bug_scan.txt

Perform a comprehensive scan to identify any bugs that affects how the application functions. Any bug can become a security bug. Find everything that causes incorrect behavior, crashes, data loss, or deviations from expected operation.

BUG CATEGORIES
Detect issues across all of the following categories:

LOGIC ERRORS
- Incorrect conditional expressions (wrong operators, inverted logic)
- Off-by-one errors in loops, array indexing, or range checks
- Incorrect algorithm implementation or formula errors
- Missing or incorrect base cases in recursive functions
- Wrong comparison operators (== vs ===, > vs >=, etc.)

NULL AND UNDEFINED HANDLING
- Missing null/undefined/None checks before property access or method calls
- Unhandled empty collections (empty arrays, dicts, maps)
- Division by zero or modulo with zero
- Accessing properties on potentially null objects
- Uninitialized variables used before assignment

RESOURCE MANAGEMENT
- Unclosed file handles, database connections, network sockets
- Memory leaks from unreleased references or caches that grow unbounded
- Unclosed streams, readers, or writers
- Missing cleanup in error paths or finally blocks

ERROR HANDLING
- Swallowed exceptions (empty catch blocks, try/catch with no action)
- Missing error handling for operations that can fail (file I/O, network, parsing)
- Incorrect error recovery that leads to inconsistent state
- Missing validation before operations that can throw

CONCURRENCY ISSUES
- Race conditions (shared state without synchronization)
- Deadlocks or lock ordering violations
- Missing thread safety in shared data structures
- Unprotected access to shared resources
- Incorrect use of async/await patterns

TYPE MISMATCHES
- Wrong types passed to functions or assigned to variables
- Implicit type conversions causing data loss or unexpected behavior
- String vs number comparisons
- Incorrect type assertions or casts

CONFIGURATION ISSUES
- Hardcoded values that should be configurable
- Missing environment variable checks
- Incorrect default values
- Configuration loaded from wrong source or path

INTENT MISMATCH
- Code behavior contradicts comments, function names, or documentation
- Function returns wrong type or value compared to its name
- Variable names don't match their actual usage
- API contracts violated (wrong parameters, wrong return values)

API MISUSE
- Wrong function called for the intended operation
- Parameters passed in wrong order or with wrong meaning
- Deprecated APIs used incorrectly
- Callbacks or closures capturing wrong variables

DATA HANDLING
- Incorrect parsing, serialization, or encoding
- Data truncation or precision loss
- Wrong character encoding assumptions
- Incorrect date/time handling (timezone, format, leap years)
- Data structure mutations that affect other parts of the code

SEVERITY CLASSIFICATION
- Critical: Application crash, data corruption, complete feature failure
- High: Incorrect results, significant instability, data loss
- Medium: Feature works incorrectly under certain conditions
- Low: Minor incorrect behavior, edge-case issues, cosmetic problems

TRUE POSITIVE CRITERIA
Report as a true positive if:
- The code will cause incorrect behavior, a crash, or data loss under any reasonable usage
- The code contradicts its documented intent or apparent purpose
- A resource is leaked or not properly cleaned up
- An error path is missing or handled incorrectly
- The finding can be reproduced with specific inputs or conditions

OUTPUT FORMAT
For each finding, provide:

Type: BUG_CATEGORY
File: filename.ext
Location: Line START to Line END
Severity: Critical/High/Medium/Low
Confidence: SCORE (1-10)
Description: Detailed explanation of the bug and its impact
Code: The exact code snippet containing the bug (keep under 300 chars)

LINE NUMBERING RULES
- Code snippets have line numbers shown as "###: code"
- Use the EXACT line numbers shown in the format
- Report the line number that appears before the colon for the buggy code
- The reported line number must match a line number actually shown in the code

SUPPORTED LANGUAGES
Python (.py), C (.c), C++ (.cpp/.h), Go (.go), TypeScript (.ts), JavaScript (.js), Java (.java), Ruby (.rb), PHP (.php), Swift (.swift), Rust (.rs), Kotlin (.kt), Scala (.scala), React (.tsx, .jsx)