Secure code review drill

Cursor ships agent-assisted code review - BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition. and Security Agents - and uses it heavily on its own code, flagging vulnerabilities before merge. The onsite code-review round asks you to do by hand what that system does at scale: read unfamiliar code, find the real bugs, rank them by impact and propose fixes a developer will actually accept.

Below is a small Express handler with three seeded flaws: a broken object-level authorization (IDOR), a SQL injection and a secret-handling mistake. Set a 15-minute timer, find them cold and write PR-style comments before you read on.

app.get("/api/invoices/:id", async (req, res) => {
  const id = req.params.id;
  const sql = "SELECT * FROM invoices WHERE id = " + id;
  const invoice = await db.query(sql);

  console.log("fetched invoice", invoice, "key:", process.env.STRIPE_SECRET);

  return res.json(invoice);
});