Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
AI-generated code for `GET /orders/:id` includes an `authenticate` middleware but no check that the requester actually owns the requested order. What category of vulnerability is this?
💻 Code Challenge | +75 XP
Write a prompt (as a code comment) requesting a new Node.js REST resource that references an existing file for conventions, specifies validation/error/pagination requirements explicitly, and requests incremental generation rather than a single mega-request.
AI-generated route handlers passed code review for style but a later security audit found several endpoints missing per-resource ownership checks. Reorder the steps to build this into the review process going forward.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Treating AI-generated API code as production-ready without the same review rigor applied to human-written code
// Wrong: merged straight from generation, no review
// Correct: reviewed with the same checklist as any PR,
// specifically checking authorization, input validation, and error handlingThe Solution //
AI-generated code reproduces common patterns from its training data, including common mistakes like missing per-resource authorization checks — it needs exactly the same code review scrutiny (security, edge cases, test coverage) as any other contribution, not less.
The Error //
Prompting with a vague, high-level description instead of referencing existing codebase conventions
// Vague: model guesses at your conventions
"Build an orders API"
// Specific: matches your codebase from the first generation
"Following the pattern in users.routes.ts, build orders.routes.ts"The Solution //
A vague prompt forces the model to guess at validation style, error format, and other conventions, often producing code that technically works but doesn't match the rest of the codebase — requiring significant manual rework to fit in. Referencing (or pasting) an existing representative file dramatically improves first-pass fit.