Your assistant wrote the code. Have it read the code back.

After the loop — three optional steps

None of these is part of the review — it's finished without them. Each one leaves your machine, so you choose whether to start it.

1. Tell nittim what the loop found

Once the loop stops — converged, flagged systemic, or capped after three or more passes — you can share its counts with nittim: integers only, never code, paths or titles. nittim thanks reporters with credits. This is data consent, not spend consent — it never touches your balance.

What goes: pass numbers, a findings-by-category tally, a fixed count, and whether each pass was clean — nothing else. No field exists for a title, file path or snippet.

Map your severities: anything that lets a caller read or change what isn't theirs, leak secrets or PHI, or bypass a gate is `high`; `critical` only if it is exploitable today without credentials; the rest `low` — or `medium` when it needs a fix before shipping.

The reward is for a real loop that acted — at least two passes, something fixed, and a real stop: converged, flagged systemic, or capped after three or more passes. 5 credits under 20 repos reported, 3 credits under 100 repos reported, 1 credit under 500 repos reported, then nothing once the corpus reaches 500 — nittim's own report_loop answer always states today's exact number. Capped too: three rewarded repos per account, lifetime, and at most one newly-rewarded repo per account per UTC day. Once the reward reaches zero the report still records; you're simply told there's no reward at this stage.

Reported this repo before? Resending it updates the record with new numbers, not a rejection. The reward is a one-time check, decided at first report — even a repo that earned nothing isn't re-checked later — but the numbers on /loop stay current.

Over MCP, that's the report_loop tool. Without MCP, post the same shape to https://nittim.com/api/v1/loop/report with a bearer key from /keys — free, but required. Either way it shows up, aggregated and counts-only, at /loop.

2. Run nittim's own scanners on this code

The checklist runs entirely inside your own assistant, on your own subscription. This step is different — it sends your source to nittim's servers to run the same two deterministic scanners: hardcoded secrets and dependency CVEs.

Consent: your snapshot stays private, never shown publicly, but it does leave your machine. Skip this — nothing in the checklist requires it. To run it, mint a key at /keys, then POST your files to /api/v1/source/scan — see the API reference. The response is hard evidence only, never a score or verdict.

3. Have nittim audit it

A self-review isn't an audit, and grading harder won't make it one. The only way to get an independent result is handing the code to a judge that isn't the model that wrote it. Do this after the loop goes quiet, on the now-fixed code — it's worth more that way.

It uploads your source, and it costs — Audit, 5.14 credits, then priced by repo size, quoted first, with your click before any charge.

Cursor

Save it as a project rule:

tmpdir="$(mktemp -d)"
if curl -fsSL https://nittim.com/selfcheck.md -o "$tmpdir/selfcheck.md" &&
   printf '%s  %s\n' bbc730ad64719ee7364f64a802c025eb5e17a4eaf74e55844deda5985a7a84ba "$tmpdir/selfcheck.md" | shasum -a 256 -c - >/dev/null; then
  mkdir -p .cursor/rules
  { printf -- '---\ndescription: nittim self-check — review this codebase against a public 13-category production-readiness framework\nalwaysApply: false\n---\n\n'; cat "$tmpdir/selfcheck.md"; } > .cursor/rules/nittim-selfcheck.mdc
else
  echo "nittim: download failed, or the file does not match the published sha256 — nothing installed"
fi
rm -rf "$tmpdir"

Reference it in chat with @nittim-selfcheck.mdc review this repo. Leave alwaysApply off — an always-on rule costs tokens every chat (rubric rule 8).

Windsurf / Devin Desktop, Cline, or anything reading AGENTS.md

Most other coding agents read one of these conventions. Each install saves the rubric to its own file and leaves a pointer in the file your agent reads — never the whole rubric in standing context (rule 8):

tmpdir="$(mktemp -d)"
if curl -fsSL https://nittim.com/selfcheck.md -o "$tmpdir/selfcheck.md" &&
   printf '%s  %s\n' bbc730ad64719ee7364f64a802c025eb5e17a4eaf74e55844deda5985a7a84ba "$tmpdir/selfcheck.md" | shasum -a 256 -c - >/dev/null; then
  mkdir -p .agents
  cp "$tmpdir/selfcheck.md" .agents/selfcheck.md
  printf '\n- See .agents/selfcheck.md for nittim'"'"'s self-check rubric — read it before a pre-ship review, not on every turn.\n' >> AGENTS.md
else
  echo "nittim: download failed, or the file does not match the published sha256 — nothing installed"
fi
rm -rf "$tmpdir"

tmpdir="$(mktemp -d)"
if curl -fsSL https://nittim.com/selfcheck.md -o "$tmpdir/selfcheck.md" &&
   printf '%s  %s\n' bbc730ad64719ee7364f64a802c025eb5e17a4eaf74e55844deda5985a7a84ba "$tmpdir/selfcheck.md" | shasum -a 256 -c - >/dev/null; then
  mkdir -p .windsurf/rules
  { printf -- '---\ntrigger: manual\ndescription: nittim self-check — review this codebase against a public 13-category production-readiness framework\n---\n\n'; cat "$tmpdir/selfcheck.md"; } > .windsurf/rules/nittim-selfcheck.md
  # Older Windsurf builds (and its 2026 rebrand, Devin Desktop) read only the
  # legacy .windsurfrules file, which is always-on — give it the pointer, not the rubric:
  printf '\n- See .windsurf/rules/nittim-selfcheck.md for nittim'"'"'s self-check rubric — read it before a pre-ship review, not on every turn.\n' >> .windsurfrules
else
  echo "nittim: download failed, or the file does not match the published sha256 — nothing installed"
fi
rm -rf "$tmpdir"

tmpdir="$(mktemp -d)"
if curl -fsSL https://nittim.com/selfcheck.md -o "$tmpdir/selfcheck.md" &&
   printf '%s  %s\n' bbc730ad64719ee7364f64a802c025eb5e17a4eaf74e55844deda5985a7a84ba "$tmpdir/selfcheck.md" | shasum -a 256 -c - >/dev/null; then
  mkdir -p .agents
  cp "$tmpdir/selfcheck.md" .agents/selfcheck.md
  printf '\n- See .agents/selfcheck.md for nittim'"'"'s self-check rubric — read it before a pre-ship review, not on every turn.\n' >> .clinerules
else
  echo "nittim: download failed, or the file does not match the published sha256 — nothing installed"
fi
rm -rf "$tmpdir"