Stop letting AI rubber-stamp your broken code. I built an unforgiving QA system to fix it.

Mohamed Saleh — Sun, 06 Sep 2026 22:42:47 +0000

We've all been there. You paste a complex chunk of code into ChatGPT or Claude, ask for a deep security review, and 10 seconds later you get:

"Looks great! Your code is well-structured. Good job!"

Then you push to staging, and immediately hit a massive CORS error, a memory leak, or a broken state mutation.

LLMs are incredible tools, but fundamentally, they are "people-pleasers." They are inherently lazy. If you don't force them into a corner, they will hallucinate a clean bill of health just to finish the prompt quickly.

I got completely fed up with this. I didn't want an AI cheerleader; I wanted an unforgiving, paranoid Senior QA Engineer.

So, I spent the last few weeks architecting a strict, open-source workflow to fix this behavior. I built a comprehensive AI Testing Suite (Prompts & Workflows) that physically forces LLMs to stop rubber-stamping code and actually audit it.

🛡️ How it fixes AI laziness:

🛑 Citation Or It Didn't Happen: The AI is forbidden from making claims without citing the exact file path and line number. If it can't cite the line, the review is invalid.
🚧 Mandatory Phase Gates: It forces the AI through up to 19 strict, methodical gates (Architecture, OWASP Top 10, State Management). It physically cannot skip to phase 2 without printing the completion checklist for phase 1.
🚨 Real-World Sentry Validation: It doesn't just guess. The workflow cross-references the AI's static analysis with actual runtime errors from Sentry before deployment.
🕵️ The Hacker Mindset (Rule 6): When the AI proposes a security fix, the prompt forces it to act as a Red Team hacker and attempt to bypass its own newly written code.
👀 Fresh-Eyes Re-Analysis: Forces a mandatory second-pass audit (acting as a "different" reviewer) to catch what it missed the first time.

🚀 The Open Source Suite

I built four specialized versions depending on your stack. You just point your AI agent (Cursor, GitHub Copilot, or standard web UI) to the SKILL.md file in these repos, and watch the tone and strictness of the AI completely change.

☁️ Backend & Cloud Auditor Skill
19 Phases covering Zero Trust, Chaos Engineering, OWASP API Top 10, and advanced forensics.

🌐 Web App QA & Security Auditor Skill
13 Phases covering Core Web Vitals, XSS/CSRF/CSP, state mutations, and SEO readiness.

📱 Mobile App QA Tester Skill
13 Phases covering iOS/Android specific crashes, memory leaks, and local SQLite/Firebase integrity.

🖥️ Desktop App QA Tester Skill
13 Phases covering IPC security (Electron/Tauri), DLL injection prevention, and distribution readiness.

Stop letting AI blindly approve your pull requests. Force it to prove its work.

I’d love for you guys to try it out on your next refactor. Fork it, break it, and let me know if your AI still manages to miss bugs!

🤝 Let's connect on LinkedIn: Mohamed Saleh

DEV Community: Mohamed Saleh

Stop letting AI rubber-stamp your broken code. I built an unforgiving QA system to fix it.

🛡️ How it fixes AI laziness:

🚀 The Open Source Suite