Six review rounds for one small app

Описание и применение

Шесть независимых ревью выявили и устранили все основные ошибки, повысив покрытие тестами и обеспечив безопасность и конфиденциальность приложения.

Задача

The app contained numerous code defects and privacy risks that were not detected by the original developer.

Результат

Six independent review rounds uncovered and resolved all major defects, improving test coverage and ensuring the app’s security and privacy compliance.

Рабочий процесс

• 1. Build app with AI agents and add security policy.
• 2. Run first AI reviewer with read‑only access to code and live site.
• 3. Fix issues found in round 1 and run automated tests.
• 4. Run second reviewer round; fix logout cookie mismatch.
• 5. Run third round; remove deleted customer data from imports.
• 6. Run fourth round; correct time zone display.
• 7. Run fifth round; enable webhook signature verification and test with unsigned request.
• 8. Run sixth round; perform acceptance test on fake data with 61 scenarios.
• 9. Observe that each reviewer’s findings are independent of the developer’s fixes.

Доказательства

The first review came back with 29 problems in the code and 13 legal or privacy risks.

Источник

The security policy I had added told the browser to refuse inline scripts, and SvelteKit starts every page with one, so the pages appeared but never came alive.

Источник

The send button took the phone number and the message text from the form and trusted both.

Источник

Between rounds I fixed what it found, and the automated tests went from 34 to 105.

Источник