Hidden Cost Audit

ai-slop-cost-bombs · v1.0.2 · paid

Catches code that will surprise-bill on the first viral moment — non-LLM cost vectors that AI tools commonly leave unbounded: file uploads with no size limit, unbounded DB queries, email/SMS without rate limits, webhooks without idempotency, and background jobs without retry caps.

Unbounded Operations

unbounded-operations · weight 0.3

Database list queries have LIMIT and pagination
ab-000237
critical
File upload handlers enforce a maximum file size
ab-000238
critical
Image processing has output dimension limits
ab-000239
high
PDF generation has page count limits
ab-000240
medium
External API calls inside loops are batched or rate-paced
ab-000241
high

Unrate-Limited Spend

unrate-limited-spend · weight 0.25

Email send routes have per-recipient rate limiting
ab-000242
high
SMS send routes are rate-limited
ab-000243
high
External API calls inside loops use Promise.all batching
ab-000244
high
External API calls have an explicit timeout
ab-000245
low

Background Job Hygiene

job-hygiene · weight 0.25

Cron jobs have execution-time limits
ab-000246
medium
Background jobs have explicit retry caps
ab-000247
high
Webhook handlers are idempotent
ab-000248
critical
User-triggered code paths have infinite-loop guards
ab-000249
medium
Background queues have a dead-letter or error-handling path
ab-000250
low

Cache & Idempotency

cache-idempotency · weight 0.2

Expensive operations are cached or marked as fresh-required
ab-000251
medium
Webhook handlers verify the signature
ab-000252
high
Third-party SDK clients are constructed once (singleton)
ab-000253
low
GET handlers consider stale-while-revalidate caching
ab-000254
info