Six review rounds for one small app

说明与用途

六轮独立评审发现并修复了所有主要缺陷，提升了测试覆盖率，确保了应用的安全和隐私合规性。

问题

The app contained numerous code defects and privacy risks that were not detected by the original developer.

结果

Six independent review rounds uncovered and resolved all major defects, improving test coverage and ensuring the app’s security and privacy compliance.

工作流

• 1. Build app with AI agents and add security policy.
• 2. Run first AI reviewer with read‑only access to code and live site.
• 3. Fix issues found in round 1 and run automated tests.
• 4. Run second reviewer round; fix logout cookie mismatch.
• 5. Run third round; remove deleted customer data from imports.
• 6. Run fourth round; correct time zone display.
• 7. Run fifth round; enable webhook signature verification and test with unsigned request.
• 8. Run sixth round; perform acceptance test on fake data with 61 scenarios.
• 9. Observe that each reviewer’s findings are independent of the developer’s fixes.

证据

The first review came back with 29 problems in the code and 13 legal or privacy risks.

来源

The security policy I had added told the browser to refuse inline scripts, and SvelteKit starts every page with one, so the pages appeared but never came alive.

来源

The send button took the phone number and the message text from the form and trusted both.

来源

Between rounds I fixed what it found, and the automated tests went from 34 to 105.

来源