Idempotency and Retry Safety
Detects HTTP POST endpoints without idempotency keys and raw INSERT statements without upsert guards, which are unsafe under retry logic.
Why this rule exists
Networks retry. Clients retry. Job runners retry. A POST that creates a duplicate row on retry is the canonical cause of double-charged customers.
Code example
+ [HttpPost("/orders")]
+ public Task<Order> Create(OrderRequest req) => _svc.CreateAsync(req);+ [HttpPost("/orders")]
+ public Task<Order> Create([FromHeader(Name="Idempotency-Key")] Guid key, OrderRequest req)
+ => _svc.CreateAsync(key, req);Configuration
Disable or adjust the severity of this rule in .gauntletci.json:
{
"rules": {
"GCI0022": { "enabled": true, "severity": "Warn" }
}
}See Configuration for the full schema.
Related rules
Data Integrity Risk
Detects unchecked casts, mass assignment without validation, and SQL ON CONFLICT IGNORE patterns that silently discard errors.
External Service Safety
Detects unsafe HTTP client usage and external service call patterns that lack timeout, cancellation, or retry configuration.
Implemented in src/GauntletCI.Core/Rules/Implementations/GCI0022_*.cs.
Eric Cogen -- Founder, GauntletCI
Twenty years as a senior technical consultant building and modernizing enterprise platforms across .NET, AWS, serverless, microservices, and AI-driven systems.