# MetaSolve Code Zone — Developer Cheat Sheet

## Before review

- Never place credentials or private source in the public trial.
- Run organization-approved format, test, SAST, dependency, and secret checks locally.
- Submit authenticated reviews inside the correct tenant-scoped project.

## Triage order

1. Confirm the source, sink, input boundary, and reachable execution path.
2. Fix Critical and High findings before release unless an authorized, expiring exception exists.
3. Add a regression test that fails before the fix and passes afterward.
4. Re-run the same analyzer/ruleset and record the new outcome.
5. Ask a reviewer to close or accept the risk; do not self-approve a release exception.

## Common fixes from the evaluation

- CWE-89: parameterize SQL; never concatenate user input into a query.
- CWE-78: avoid shell strings; pass validated arguments without `shell=True`.
- CWE-22: resolve against an allowed root and reject paths that escape it.
- CWE-94: remove dynamic evaluation; parse an allowlisted grammar instead.
- CWE-798: use the organization secret manager and rotate exposed values.
- CWE-404: use context managers or guaranteed cleanup paths.

## Result states

- Passed: evidence met the defined gate; still respect reviewer and deployment scope.
- Review: a human decision or missing evidence remains.
- Blocked: do not promote the artifact.
- Analyzer/ruleset failure: not a clean result; stop and investigate.