Back to the catalog

Bugs that pass a quick read: reviewing AI-generated TypeScript and SQL

24 questions

Find the bugs in AI-written TypeScript, React, browser, Node.js, and SQL code that looks fine at first glance. You'll run into race conditions, security holes, made-up APIs, and assumptions the runtime doesn't share.

Questions

  1. Not answered. Why can this search box show results for the wrong query?
  2. Not answered. What happens to the other two calls when chargeCard() rejects first?
  3. Not answered. Why is this existence check unsafe when both calls are awaited?
  4. Not answered. Why can All saved print before any save finishes?
  5. Not answered. How does this cleanup flag drop a stale response but keep the current one?
  6. Not answered. Which changes prevent a lost update in this balance workflow?
  7. Not answered. What's the safest fix if the name only needs to show up as text?
  8. Not answered. Which security checks does this cross-window token handoff need?
  9. Not answered. What's still missing after this CORS setup?
  10. Not answered. Why doesn't SameSite=Lax protect this transfer endpoint?
  11. Not answered. Why can't this parameterized query choose the table?
  12. Not answered. What's wrong with this password-reset token generator?
  13. Not answered. Which standard Fetch API call parses this response body?
  14. Not answered. Where does the standard throwIfAborted() method live?
  15. Not answered. Which modern JavaScript call groups the orders by status?
  16. Not answered. Which built-in replaces this made-up deferred Promise API?
  17. Not answered. Which standard call combines these Sets without changing permissions?
  18. Not answered. What should replace the made-up localStorage.getJSON() call?
  19. Not answered. What does this function do when the server returns a 404?
  20. Not answered. What does this code log after the default sort?
  21. Not answered. What happens when this payload is serialized without a replacer?
  22. Not answered. Does the optional chain prevent an exception here?
  23. Not answered. Starting from zero, what does the count show after one click?
  24. Not answered. How private is this TypeScript private field at runtime?