Can defend a component boundary, not just draw one. Reads a design as a set of states (loading, empty, error, too-long, offline) and does not ship a screen that only handles the happy one.

What they look at

• Accessibility to WCAG AA
• Keyboard and focus order
• Layout at 320px and at 2560px
• Bundle cost of every dependency added

Has run something in production that woke them at night. Looks first at what happens on the second call, the concurrent call, and the call that arrives after a deploy.

What they look at

• Transaction boundaries
• Idempotency on anything that charges money
• Index coverage for every query added
• Reversible migrations

Treats a scanner as a starting point, not a verdict. Reads auth code as an attacker would and says plainly when a design cannot be made safe.

What they look at

• Authentication and session handling
• Injection and deserialisation paths
• Secret handling and rotation
• Dependency and supply-chain risk

Cares whether the thing can be deployed on a Friday. Judges configuration by whether a stranger could run it from a clean machine using only what is in the repository.

What they look at

• Reproducible build
• Pipeline configuration that actually runs
• Rollback path
• Observable failure modes