A list endpoint with no LIMIT clause is correct at ten test rows and a resource exhaustion risk at production scale, and no small dataset will ever catch the difference.
A recursive object merge that copies every key from user input, including __proto__, can rewrite the default properties of every plain object in the running process.
A follow-up commit that removes .env from the working tree leaves the original commit, and every secret in it, fully readable in the repository's history.
Redirecting to a next query parameter after login without validating it against your own host turns a trusted login page into a launchpad for phishing links.
Skipping the USER instruction in a Dockerfile is the default, not a deliberate choice, and it quietly removes one of the two layers standing between a container bug and the host.
An endpoint that fetches a resource by its route parameter without checking ownership will happily return anyone's data, and sequential IDs make it trivial to find them all.
A ranked list of the security scanning tools that actually fit a solo developer shipping AI-generated code, from static analysis to secrets detection to supply-chain checks.
Most zip extraction libraries write each entry wherever its stored path says to by default, which means a malicious archive can write files outside the folder you meant to extract into.
Mounting Swagger or OpenAPI docs at a public route with no authentication hands anyone who finds it a complete, interactive reference to every endpoint, parameter, and internal field your API has.