Read AI code like a reviewer

AI code often works in the happy case and fails in the others. Reviewing means looking for what the code forgot, not only checking what it does.

// Looks fine, and works in a demo
app.get("/invoice/:id", requireLogin, async (req, res) => {
  const invoice = await db.invoices.find(req.params.id);
  res.json(invoice);
});

Any signed-in user can change the id in the address and read someone else's invoice. Being signed in is not the same as being allowed. The fix is to check that the invoice belongs to this user.

const invoice = await db.invoices.find(req.params.id);
if (!invoice || invoice.userId !== req.user.id) {
  return res.status(404).send("Not found");
}
res.json(invoice);

Questions to ask of every change

• Who is allowed to do this, and where is that checked?
• What happens with empty, huge or strange input?
• What happens if the network or the database fails?
• Does it change anything that it did not need to change?

🔬 Try it: would you approve this AI code? →