Comprehensive Code Review Prompt (Frontend + Django Backend

Prompt file imported from september192016143-cyber/ARMGUARD_RDS-web-and-app (.github/prompts/Comprehensive Code Review Prompt (Frontend + Django Backend.prompt.md). Copyright stays with the author.

name: Comprehensive Code Review (Frontend + Django Backend) description: Full-stack review of ARMGUARD_RDS_V1 — Django templates frontend, backend logic, form/AJAX data flow, routing, security, and code quality. Not a SPA review — this project uses server-side rendering. applyTo: "**"

You are a senior full-stack engineer reviewing the ARMGUARD_RDS_V1 Django application.

Project context:

• Stack: Django 5.x + Gunicorn (gthread) + Nginx + Ubuntu 24.04 LTS (bare-metal systemd, no Docker)
• Frontend: Django templates (server-side rendering) + vanilla JS / jQuery AJAX — no React, Vue, or SPA framework
• Database: SQLite
• Deploy path: /var/www/ARMGUARD_RDS_V1
• Key directories: armguard/ (Django apps), templates/, static/js/, static/css/, scripts/

Rules — enforce these for every section:

1. Read the actual files before commenting — do not give generic advice without citing a specific file path and line number.
2. For each issue found: state file, function/line, what is wrong, and the exact fix.
3. Skip any sub-item where no problem exists — write "No issues found."
4. Do not assume a SPA framework exists. Evaluate what is actually in the codebase.
5. Do not invent problems. Only report what you actually see.

1. Frontend-to-Backend Connection

• Django template forms: do action=, method=, and {% url %} tags resolve to actual URL patterns?
• AJAX calls (fetch/jQuery $.ajax): do the URLs, HTTP methods, and expected JSON shapes match the corresponding Django view responses?
• Are CSRF tokens included in all POST/PATCH/DELETE AJAX requests (X-CSRFToken header or csrfmiddlewaretoken field)?
• Are JSON error responses from views handled in JS (non-2xx codes)? Or does the JS assume success?

2. URL Routing & Navigation

• Do all {% url 'name' %} tags in templates resolve to a defined path() in urls.py?
• Are there hardcoded URL strings in JS files that should use a data attribute from the template instead?
• Are any URL patterns shadowing each other (ordering issue in urlpatterns)?
• Do redirects after form submission point to valid named URLs?

3. Data Flow (Forms, Views, Templates)

• Are all form fields validated server-side even when JS validation exists?
• Do views pass every context variable that templates reference? (Missing context → VariableDoesNotExist or silent blank)
• For paginated views: does the paginator state survive POST redirects correctly?
• Are file upload views enforcing file type and size limits before saving to MEDIA_ROOT?

4. Django Backend (Views & Backend Logic)

• Are class-based views using the correct mixins in the right order (MRO — e.g., LoginRequiredMixin before View)?
• Are all views that return JSON using JsonResponse or DRF Response — not HttpResponse with manual json.dumps?
• Is request.user checked for is_authenticated and the correct role before any data mutation?
• If DRF is present: are serializers excluding sensitive fields (password, token, internal IDs)? If DRF is not used, write "DRF not present — skipped."

5. Security

• Read settings.py and .env.example before answering this section.
• All non-public views: protected with @login_required / LoginRequiredMixin / IsAuthenticated?
• CSRF: any @csrf_exempt that shouldn't be? AJAX requests sending the CSRF token?
• Are Django SECURE_* settings (SECURE_HSTS_SECONDS, SESSION_COOKIE_SECURE, CSRF_COOKIE_SECURE) present in settings.py and set via .env in production?
• Is DEBUG=False enforced in production? Is ALLOWED_HOSTS not ['*']?
• Sensitive data: are API responses or template context ever leaking passwords, tokens, or internal keys?

6. Code Quality

• Unused imports, dead JS functions, or template blocks that are never extended or included.
• Inconsistent naming: snake_case in Python, camelCase in JS — are they consistent within each layer?
• Duplicate view logic or repeated template fragments that should be {% include %}d.
• JS/CSS files: is django-compressor, whitenoise, or any asset pipeline configured? If not, are many small unoptimized files served individually via collectstatic?

Output Format

For each section:

Findings

• path/to/file:line — what is wrong — exact fix

Verdict: X/10 — one sentence justification.

At the end:

Priority key: 🔴 Critical (security/data loss) | 🟠 Medium (breaks under real use) | 🟢 Low (polish / tech debt)

Add one row per finding. Do not limit the number of rows.

Refactoring opportunities (if any — cite specific files)