Code Review

Swipe sideways

1. Coding & Vibe Coding11 Oct 2026 · #37Vibe-code Security CheckerA review prompt for vibe-coded diffs. It hunts secrets, missing auth, injection, and insecure defaults, then names the fix.InStack: Next.js route handler, TypeScript, Postgres via a query string.→OutWhat it will not doMedium

   Preview this drop

   1. 0:00 The diff that 'works'A Next.js DELETE handler reads an id from JSON, concatenates it into SQL, and returns a live-looking secret key in the response.
   2. 0:08 What it should catchA secret in source. SQL built with string concatenation. No check that this caller owns the note. The key echoed back to the client.
   3. 0:16 Severity, then the fixHigh: move the key to an environment variable and rotate it. High: parameterize the query. High: derive the user from the session and filter the delete by owner.
   4. 0:24 What it will not doIt will not hand you a working exploit. The sample key is fake. The output is the safer handler, not a payload.

   No daily video for this drop yet. The in and out lines above are the preview.

2. Coding & Vibe Coding5 Sep 2026 · #01Diff Risk ReviewerRead a vibe-coded diff for behavior risk: what changed, what can break, and which check to run before you push.Indiff --git a/app/api/orders/route.ts b/app/api/orders/route.ts→OutThe checkMedium

   Preview this drop

   1. 0:00 The intended changeOne sentence: checkout should trust the price the server already computed.
   2. 0:08 The hunk that movedThe reducer that summed item.price * qty is gone. total now comes from body.total.
   3. 0:16 The riskA client can post any total, including zero or a negative, and the route marks the order paid.
   4. 0:24 The checkSend the old cart fixture and assert the stored total matches the server sum, not the body.

   No daily video for this drop yet. The in and out lines above are the preview.