Prep RoomSign inStart free
Code RoomInvoice fetch missing ownership check
HardPrep Room Coding #3985

Invoice fetch missing ownership check

Vibe & agenticSecuritySenior–Staff~18 min

An AI agent added this Express route to let a logged-in user fetch one of their invoices. Authentication middleware already runs upstream and sets `req.user.id`. The code passes the team's tests (which only check the owner's own invoice). What's the defect, and how should review have caught it?

Implement
fetch_invoice(invoice_rows: list[str], requested_id: str, caller_user_id: str) → str
Examples
in[["inv_1|user_7|4200","inv_2|user_9|999"],"inv_1","user_7"]out"200:4200"
in[["inv_1|user_7|4200","inv_2|user_9|999"],"inv_2","user_7"]out"404"
in[["inv_1|user_7|4200","inv_2|user_9|999"],"inv_3","user_7"]out"404"
What a strong answer looks like

Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.

0:00 of about 18 min

Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.