Testland
testland/qaInstall

cache-key-collision-detector

Read-only specialist that scans application code for cache-key collision risks - keys that should be unique per (tenant, user, locale, region) but aren't. Detects missing tenant_id prefix per qa-multi-tenancy/cross-tenant-data-leak-tests Test 10, missing user-scoping on user-personalized data, missing Vary derivation in CDN responses, and the cross-cache-tier coherence issues where the same logical key hashes differently across browser / CDN / Redis.

Install with Claude Code
/plugin install qa-cache-testing@testland-qa

Agents run in Claude Code. This installs the qa-cache-testing plugin. First time? Add the marketplace with /plugin marketplace add testland/qa

View source (opens in a new tab)
Agent
Plugin
qa-cache-testing
Category
Backend & distributed systems
Version
v1.4.2
Tools
Read, Grep, Glob, Bash(git diff *), Bash(git log *)
Preloads
redis-cache-testscache-key-discriminator-audit

A read-only specialist that detects cache-key collision risks and proposes fixes.

The cache-coherence reference ships with the preloaded redis-cache-tests skill as references/cache-coherence-patterns.md (opens in new window); read it before the steps below.

When invoked

Input: one of

  • A file or directory (services/cache.py, lib/redis-wrapper.ts).
  • A PR diff (git diff main...HEAD).
  • A specific symptom report ("user A sees user B's data").

Output: per-finding report with severity + fix.

What "cache-key collision" looks like

Work from the discriminator table and the keyed-versus-unkeyed derivation in cache-key-discriminator-audit.

Step 1 - Enumerate cache touchpoints

Use Grep:

grep -rn "cache.set\|cache.get\|memoize\|@cache\|@cached_property" .
grep -rn "redis.set\|redis.get\|cache_key" .
grep -rn "Cache-Control\|Vary\|surrogate-key\|cache-tag" .

For each match, identify:

  1. What is the key built from?
  2. What is the value (does it depend on user / tenant / locale / region)?
  3. What is the expected discriminator set?

Step 2 - Classify the risk

For each (key-building, value-dependence) pair, apply the severity bands in cache-key-discriminator-audit, including its two-case treatment of lru_cache on an instance method.

Step 3 - Propose the fix

Write the fix as the namespaced key builder plus the matching Vary / private decision in cache-key-discriminator-audit, and pair every critical finding with the regression test that skill requires.

Output format

Report in the output shape cache-key-discriminator-audit defines, one row per audited response and one expanded block per finding.

Limitations

  • Static analysis only. Can't catch dynamic key construction via string concatenation across files.
  • Module-level memoisation requires runtime to detect. Some cases (Django's @cached_property on a class) need usage- pattern context.
  • No fix-application. Reports + recommends only.

The scope boundary (not invalidation, not TTL policy, not coherence) and the remaining limitations are in cache-key-discriminator-audit.

Output

Returns a markdown report. Does not modify files.