Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is AI security review considered one layer of a defense-in-depth process rather than a replacement for dedicated security tooling and human expertise?
💻 Code Challenge | +75 XP
Write a targeted security review prompt specifically requesting a check of every route in a file for missing per-resource authorization checks, as opposed to a generic "check for security issues" request.
A generic AI security review of a large payment-processing module reported no issues, but a subsequent human security audit found a subtle business-logic authorization bypass. Reorder the steps that should have been part of the process to catch this earlier.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Treating a general "check for security issues" AI review as sufficient sign-off for genuinely sensitive code
// Insufficient alone for sensitive code:
"Check this payment code for security issues" → AI review only
// Correct: AI review as ONE layer, human review still required
AI review (one input) + mandatory human security review = actual sign-offThe Solution //
A generic review request spreads attention broadly and shallowly across many possible issue categories, and AI review in general is less reliable for business-logic-specific or cross-file vulnerabilities. For sensitive code paths (authentication, payments, PII handling), a required human security review remains essential, not optional.
The Error //
Using only a generic security review prompt instead of targeting a specific vulnerability category
// Broad, shallow
"Check this for security issues"
// Focused, thorough for the category that matters most here
"Check every route in this file specifically for missing authorization"The Solution //
A generic prompt tends to produce broad, shallow coverage across many possible categories rather than a thorough check of any single one. A targeted prompt focused on one specific category (like authorization, or injection) directs the model's attention more effectively, producing more thorough coverage of that specific area.