Secure code review drill

Cursor ships BugbotCursor's automated PR reviewer that posts inline findings and can push fix commits from isolated VMs. Press Enter for the full definition., which reviews pull requests, and Security Agents: a Security Reviewer that checks PRs and a Vulnerability Scanner that runs on a schedule. Expect a code-review round that asks you to do by hand what those tools do at scale. Read unfamiliar code cold, find the real bugs, rank them by impact and propose fixes a developer will actually accept.

Below is a small Express handler with three seeded flaws. One is a broken object-level authorization bug, the IDOR. The others are a SQL injection and a secret-handling mistake. Set a 15-minute timer, find them cold and write PR-style comments before you read on.

app.get("/api/invoices/:id", requireAuth, async (req, res) => {
  const id = req.params.id;
  const sql = "SELECT * FROM invoices WHERE id = " + id;
  const invoice = await db.query(sql);

  console.log("fetched invoice", invoice, "key:", process.env.STRIPE_SECRET);

  return res.json(invoice);
});