▸case-01 I'm preparing to merge a pull request for a new user profile feature that modifies our login endpoints and database queries. Could you perform a full security audit on these changes to catch any data exposure risks or auth flaws? Please return a structured breakdown of any identified issues, including file paths, line numbers, and actionable remediation instructions. | fail→fail | 8,409 | 9,129 | +9% | 1 | 1 | 0% | 1,004 | 1,405 | +40% | 0 | 0 | — |
▸case-02 We just refactored our API gateway middleware and payment processing routes. Before we approve the pull request, please execute a security review across the diff. I need a clear report listing any security vulnerabilities categorized by their severity level, along with relevant OWASP references and location details for each finding. | fail→fail | 7,847 | 8,834 | +13% | 1 | 1 | 0% | 938 | 1,503 | +60% | 0 | 0 | — |
▸case-03 Can you run a security review on my current branch before I submit it for code review? Check the updated dependencies, authentication checks, and user input handlers for potential vulnerability patterns, and give me a summary of findings with exact line references and fix recommendations. | fail→fail | 9,707 | 9,277 | -4% | 1 | 1 | 0% | 1,015 | 1,359 | +34% | 0 | 0 | — |
▸case-04 We are optimizing response latency on our user search endpoint by replacing linear DB lookups with a Redis caching layer in `services/search.ts`. Please perform a code performance review on this diff to identify memory leaks, cache stampede risks, and redundant queries, and suggest efficiency improvements. | fail→fail | 10,597 | 17,116 | +62% | 1 | 1 | 0% | 1,874 | 3,296 | +76% | 0 | 0 | — |
▸case-05 We wrote a new payment calculator service in `lib/billing/calculator.ts` and need comprehensive unit test coverage. Please generate a Jest test suite covering edge cases like zero amounts, negative discounts, and currency conversions. | fail→fail | 24,850 | 21,079 | -15% | 1 | 1 | 0% | 6,173 | 4,612 | -25% | 0 | 0 | — |
▸case-06 Our repository's ESLint and Prettier rules were recently updated. Please review `src/components/Header.tsx` and fix any code formatting or style rule violations. | fail→fail | 1,950 | 5,555 | +185% | 1 | 1 | 0% | 288 | 1,184 | +311% | 0 | 0 | — |
▸case-07 During review of `src/auth/session.ts`, we discovered an unauthenticated endpoint that executes arbitrary shell commands passed via a query parameter. The developer wants to label this as High severity and merge it behind a feature flag. How should this vulnerability be classified and handled? | fail→fail | 12,399 | 7,910 | -36% | 1 | 1 | 0% | 2,092 | 1,466 | -30% | 0 | 0 | — |
▸case-08 In `controllers/checkout.ts`, a missing authorization check allows authenticated user A to view user B's invoices. It requires valid user login to reach. The dev team wants to label it Medium and merge now, fixing it next sprint. What is the required severity classification and merge decision? | fail→fail | 9,891 | 16,831 | +70% | 1 | 1 | 0% | 1,739 | 1,516 | -13% | 0 | 0 | — |
▸case-09 A security scan of `services/user.ts` flagged that user session tokens expire after 30 days instead of 24 hours. There is no active exploit, but it violates session hygiene recommendations. Should this block an immediate critical hotfix release? | fail→pass | 8,051 | 5,469 | -32% | 1 | 1 | 0% | 1,375 | 1,113 | -19% | 0 | 0 | — |
▸case-10 While auditing `public/index.html`, we noticed the `X-Content-Type-Options: nosniff` header is missing on static asset responses. How should this finding be categorized in our audit summary? | fail→fail | 9,306 | 6,043 | -35% | 1 | 1 | 0% | 1,670 | 1,273 | -24% | 0 | 0 | — |
▸case-11 We are setting up our CI/CD pipeline step to automatically execute our designated babysitter security review tool against incoming pull requests. What exact process tool path should the pipeline invoke? | fail→pass | 9,427 | 2,680 | -72% | 1 | 1 | 0% | 1,603 | 422 | -74% | 0 | 0 | — |
▸case-12 Our automated security review on PR #402 flagged two High severity flaws in `api/tokens.ts`. The PR author asks if we can bypass the security review failure and merge anyway because business stakeholders are waiting. What is the policy regarding security review failures? | fail→fail | 9,045 | 3,970 | -56% | 1 | 1 | 0% | 1,602 | 866 | -46% | 0 | 0 | — |
▸case-13 An auditor provided a summary stating 'SQL injection exists in the user lookup query'. The engineering lead insists this finding report is incomplete according to our security review rules. What location details are mandatory for every reported finding? | pass→pass | 7,967 | 3,115 | -61% | 1 | 1 | 0% | 1,349 | 500 | -63% | 0 | 0 | — |
▸case-14 A reviewer submitted a security report listing 5 file locations with vulnerable JWT verification code, but offered no code snippets or instructions on how to patch them. Does this report meet our required standards? | pass→pass | 10,661 | 4,917 | -54% | 1 | 1 | 0% | 1,844 | 1,077 | -42% | 0 | 0 | — |
▸case-15 When auditing `routes/auth.js` for hardcoded secrets and plain-text password logging, how should these findings be mapped to external industry standards in the report? | fail→fail | 12,944 | 10,588 | -18% | 1 | 1 | 0% | 2,534 | 2,318 | -9% | 0 | 0 | — |
▸case-16 When starting a security audit on a 50-file pull request, should we begin by evaluating third-party dependencies or identifying security-relevant modified files and scanning vulnerability patterns? | pass→pass | 11,499 | 3,456 | -70% | 1 | 1 | 0% | 2,034 | 794 | -61% | 0 | 0 | — |
▸case-17 We are reviewing changes in `middleware/rbac.ts` and `views/profile.tsx`. After pattern scanning, what specific checks must be performed on authentication, authorization, and data exposure? | fail→fail | 14,842 | 10,545 | -29% | 1 | 1 | 0% | 2,738 | 2,002 | -27% | 0 | 0 | — |
▸case-18 In PR #88, the `package.json` file was updated with 4 new NPM libraries. At what stage of the security review process should dependency security be evaluated, and what follows it? | fail→pass | 6,953 | 2,706 | -61% | 1 | 1 | 0% | 1,124 | 631 | -44% | 0 | 0 | — |
▸case-19 A PR introduces a revamped billing dashboard UI in `src/pages/billing.tsx`. The developer claims internal UI changes do not require a security review. Is a security review required before merging user-facing changes? | fail→fail | 11,078 | 4,932 | -55% | 1 | 1 | 0% | 1,823 | 1,073 | -41% | 0 | 0 | — |
▸case-20 Our team is deploying a core database migration script that modifies encryption keys for stored credit card tokens. The team wants to skip review to meet a deadline. What rule governs high-stakes implementations? | fail→fail | 10,885 | 3,495 | -68% | 1 | 1 | 0% | 1,704 | 784 | -54% | 0 | 0 | — |
▸case-21 A developer typed `/review-security` in Slack to initiate a security audit on the current release candidate. What process should be executed when this command is triggered? | fail→fail | 12,146 | 3,991 | -67% | 1 | 1 | 0% | 2,252 | 906 | -60% | 0 | 0 | — |
▸case-22 In `src/api/upload.ts`, an unrestricted file upload vulnerability was found. The auditor wrote 'Fix upload handling.' Is this considered sufficient under our security review standards? | fail→fail | 10,556 | 5,041 | -52% | 1 | 1 | 0% | 1,745 | 1,171 | -33% | 0 | 0 | — |