Field notes from the review team
Learn to ship code that survives
The mistakes every team makes — in the code we write and the code we generate — and how to catch them before they ship. Friendly, concrete, ten minutes at a time.
Security
Trust boundaries, and the code attackers read more carefully than we do
Why AI-Generated Code Needs a Security Pass
AI assistants write code that looks finished — and that polish is exactly what lowers a reviewer's guard. The blind spots I keep finding in generated code, and a routine that catches them.
Sessions, Cookies, and the Requests You Didn't Send
Your browser attaches cookies to requests you never meant to make. A working tour of CSRF, httpOnly and SameSite, and why a state-changing GET is a trap waiting to spring.
The Parameter You Didn't Mean to Accept
Mass assignment turns a convenient framework feature into a privilege-escalation path. How over-permissive param lists happen, and how to review the permit list like it matters.
Hiding the Button Is Not Security
If the only thing stopping a user from deleting the project is that they can't see the Delete button, nothing is stopping them. Why authorization must live on the server.
It's 2026 and Injection Still Happens. Here's Why.
SQL injection is old enough to rent a car, yet it keeps shipping — often via string interpolation that looks harmless. Why parameterization is non-negotiable, especially in generated code.
Multi-Tenant Apps Live or Die on Scoping
In a multi-tenant system, one missing WHERE clause is a data breach. Where tenant isolation actually breaks — jobs, exports, admin paths — and how to build scoping you can trust.
The Most Common API Bug I See in Review: IDOR
Insecure direct object references are boring, ancient, and still everywhere. Why find(params[:id]) needs a scope, and how to review for object-level authorization.
Secrets Don't Belong in Repos (Even Private Ones)
A hardcoded API key feels harmless right up until it isn't. How secrets leak through repos, logs, and error trackers — and the habits that keep them out.