The pairing is what makes the rubric enforceable. A finding has to cite path:line, and a pass has to point at either a flag, a trivially revertible change, or the rollback plus who can execute it [4][9]. Each half removes a class of comment. path:line removes "this feels risky" [4]. The named rollback removes the finding nobody can act on when the pager goes off.
The smallest data blocker in the post is a one-line diff: `status TEXT` becomes `status TEXT NOT NULL` [12]. No default, no UPDATE [11]. Which failure mode you get depends on your migration runner, because either the migration fails on apply, or the check is skipped and reads throw later [13]. The prescribed order is backfill first, set NOT NULL in a follow-up, or choose a default that matches what the product currently means and write that down [14]. A TODO with an owner is a warning, not a pass [15].
The contract case is where the model's fluency does the damage. `GET /v1/invoices/:id` returned `amount` as integer cents, and the model returns `(invoice.cents / 100).toFixed(2)` with the field name untouched [16]. Existing mobile builds read `"12.50"` as 12 cents or throw, and cannot be force-updated that afternoon [17]. On a $12.50 invoice that is 1250 against 12, off by a factor of about 104 [18]. The author reports the review comment such a diff attracts: "nice, more readable for clients" [16]. The fix is additive, `amount_decimal` or a `/v2`, with `amount` left as integer cents until the old clients are gone [19].
What the rubric costs to adopt sits in its pass conditions rather than its blocker list. "Gate it, or keep the legacy path behind something you can flip at 2am without a deploy" is a review comment if you already have flags, and a quarter of platform work if you do not [20]. Same for being able to ship a `/v2` [19], and for expand/migrate/contract being a sequence your tooling supports [15]. Point this at an agent-heavy repo without that infrastructure and most risky PRs score as blockers, which converts a review policy into a platform backlog. That is useful information, delivered by an unusual route.
Scope note. The supplied text names eight blockers and details four, cutting off inside the authz section, where the examples are IDOR from a client-supplied id and an "internal" endpoint becoming newly reachable [22][21]. It is one practitioner's rubric published on dev.to, with no defect rates and no before-and-after [1]. For the rest of it to transfer you need the conditions it assumes: clients you cannot redeploy in lockstep, and CI that goes green because the new function has unit tests while proving nothing about the rows already in the table [8].
