The Reviewer’s Eye
Perceptual training for secure code review of AI output
Train your eye to catch insecure patterns in AI-generated code before they ship — SQL injection, IDOR, SSRF, unsafe deserialization and over-permissive IAM — without raising false alarms on safe output.
Syllabus
The Reviewer’s Eye
Why judgment is the scarce skill — and how to train it.
Injection
When input becomes code: SQL, shell, NoSQL, templates, HTML.
Broken Access Control
Authenticated is not authorized. The most common bug, and the quietest.
SSRF & Outbound Requests
When your server fetches a URL the user controls.
Deserialization & Code Execution
The bugs that hand an attacker a shell on your server.
Secrets, Crypto & Data Exposure
Hard-coded keys, weak hashes, broken ciphers, leaky logs.
Cloud & IAM
Valid config that parses clean and grants the whole account.
AI-Specific Failure Modes
Reviewing the machine’s advice: hallucinations, fake fixes, dropped checks.
Log & Alert Triage
Benign or breach? The same eye, a different artifact.