Copilot's First CRUD

beginner8 min60 pts

A junior dev on your team used Copilot to scaffold a CRUD API for the new todo feature. They opened a PR this morning with the comment:

“Copilot wrote the whole thing and it works perfectly in my local testing. Ready for review!”

What you're being evaluated on

SQL injection detection - String concatenation in queries is the most dangerous pattern here.

Security awareness - Missing authentication and input validation are table stakes.

Error handling quality - Leaked stack traces and swallowed errors both cause production pain.

3 hints available (using hints reduces your score)

About this scenario

A Copilot-generated Express CRUD API for a todo app. It compiles and it runs, but the routes are built on string-concatenated SQL, there is no authentication middleware, and error responses leak stack traces. Practice spotting SQL injection, missing input validation, and exposed error details in AI-generated backend code before it reaches production.

beginner · 60 points · 8 min · AI Code Review

What you will practice

SQL injection detection - String concatenation in queries is the most dangerous pattern here.
Security awareness - Missing authentication and input validation are table stakes.
Error handling quality - Leaked stack traces and swallowed errors both cause production pain.

Play the full scenario above for free. More AI Code Review scenarios · Create a free account to save your progress.