Idempotency and Retry Safety
Detects HTTP POST endpoints without idempotency keys and raw INSERT statements without upsert guards, which are unsafe under retry logic.
Why this rule exists
Networks retry. Clients retry. Job runners retry. A POST that creates a duplicate row on retry is the canonical cause of double-charged customers.
Code example
+ [HttpPost("/orders")]
+ public Task<Order> Create(OrderRequest req) => _svc.CreateAsync(req);+ [HttpPost("/orders")]
+ public Task<Order> Create([FromHeader(Name="Idempotency-Key")] Guid key, OrderRequest req)
+ => _svc.CreateAsync(key, req);Configuration
Disable or adjust the severity of this rule in .gauntletci.json:
{
"rules": {
"GCI0022": { "enabled": true, "severity": "Warn" }
}
}See Configuration for the full schema.
Related rules
Data Integrity Risk
Detects unchecked casts, mass assignment without validation, and SQL ON CONFLICT IGNORE patterns that silently discard errors.
External Service Safety
Detects unsafe HTTP client usage and external service call patterns that lack timeout, cancellation, or retry configuration.
Implemented in src/GauntletCI.Core/Rules/Implementations/GCI0022_*.cs.
Eric Cogen -- Founder, GauntletCI
Twenty years in .NET production. Most of those years, the bugs that hurt me were not the ones tests caught. They were the assumptions I did not know I was making: a removed guard clause, a renamed method that still did the old thing, a catch {} that turned a page into a silent dashboard lie. GauntletCI is the checklist I wish I had run before every commit. It runs the rules I learned the hard way, so you do not have to.