Research sample catalogue

Real analysis based on human research.
Our tool upgrades the programmer, not just the program.

Explore real Hattrick code research reports for production MCP, FastAPI, pgvector, Node.js, Python asyncio, React, PostgreSQL, and TypeScript problems. Each sample includes the submitted source, exact code evidence, a prioritized modernization path, and authoritative references.

  1. 01

    Secure TypeScript MCP server

    Node.js 26

    The server uses current MCP v2 concepts, but passes the wrong handler shape to the Node adapter. Its OAuth metadata target, Origin and Host validation, tool authorization, quotas, and shutdown ordering also need correction before production use.

    8,470 charactersTypeScript3 findings
  2. 02

    Production FastAPI and pgvector RAG API

    Python 3.14

    The API has useful transaction-local RLS context, parameterized hybrid search, deadlines, and explicit engine disposal. Direct exposure is still unsafe because identity comes from unsigned headers, while retrieval ignores the embedding model and dimensions already stored in the schema.

    9,202 charactersPython3 findings
  3. 03

    Reliable Node.js webhook and job processing

    Node.js 24

    The worker uses current cancellation and resource-management APIs, but response streams, detached promises, and heartbeat renewals need explicit ownership before the implementation is dependable under sustained load.

    18,587 charactersTypeScript3 findings
  4. 04

    Graceful Python asyncio worker shutdown

    Python 3.14

    The supervisor uses TaskGroup and asyncio.timeout correctly in isolation, but the enclosing TaskGroup can continue waiting after the drain timer expires. Cancellation cleanup and race participants also need stronger task ownership.

    16,938 charactersPython3 findings
  5. 05

    React request races and effect cleanup

    React 19

    The loading effect cancels cooperative fetch work, yet save, activity, and reload callbacks can still write stale state after a project change. Request identity guards close the race without forcing a framework migration.

    8,942 charactersTypeScript / React3 findings
  6. 06

    PostgreSQL durable queue claiming

    PostgreSQL 17

    FOR UPDATE SKIP LOCKED is used correctly for concurrent queue consumption, and lease tokens reject stale completion. The privileged functions still trust a caller-supplied tenant identifier, creating the highest-impact defect in the sample.

    9,993 charactersPostgreSQL3 findings
  7. 07

    Fetch timeouts and cancellation

    Web platform

    The cancellation primitive is current, but the helper leaves important failure behavior implicit. Keep AbortController, then make HTTP errors and timeout semantics explicit.

    326 charactersTypeScript3 findings

What every Hattrick research sample includes

01

Runtime-aware review

The declared language and runtime shape which syntax, APIs, and modernization techniques are considered current.

02

Evidence from the code

Important findings quote the submitted source and preserve file and line locations when available.

03

Sources engineers can inspect

Recommendations point to relevant standards and official documentation rather than generic homepages.