2 min lesson
Score yourself honestly
Work through this: "In the invoice handler, the reviewer suggests returning 403 when a user requests an invoice they don't own. Why might 404 be the better choice and what broader principle does it reflect?"
Step 1 of 3
Score yourself honestlyFindings caught vs missed and fix quality
- Did you catch all three or did one slip? Which class did you miss - authz, injection or secret handling?
- Did you rank by impact or list them in the order you happened to read them?
- Did your fix remove the bug class (ownership in the query) or just patch the one line?
- Did you flag the secret as needing rotation, not just removal from the log line?
The most-missed flaw in this drill is the IDOR, because the code “looks fine” - there's no scary string concatenation to draw the eye. Broken object-level authorization is the top item on the OWASP API list precisely because it's invisible in a quick read. Train the habit: on every handler that takes an id, ask who is allowed to see this object and where is that enforced?
Mirror the agent-assisted-review output style: one finding per comment, each with severity, the exploit in one sentence and a copy-pasteable fix. Interviewers read that as someone who's shipped security review at scale, not someone auditing for the first time. End with the prioritization call - which one blocks the merge - because triage judgment is what separates a senior reviewer from a linter.
Log the vuln class you keep missing across drills. If IDOR slips twice, that's not bad luck, it's a blind spot - revisit the secure-coding module on broken access control and re-run this drill with a fresh snippet.