Ask your AI Ask your AI to turn this code into a guided bug-finding exercise.
Claude ChatGPT I am reading "A request carries a correctly verified access token. What must the order endpoint still decide?" on CodeWiki (https://codewiki.com/practice/mcq/security/api-security/authentication-is-not-authorization/).
Context (verbatim from the page):
"""
A request carries a correctly verified access token. What must the order endpoint still decide?
Whether this principal may perform this action on this order and view the selected fields
Whether the token can be Base64url-decoded
Whether the browser displayed the order button
"""
Introduce three subtle bugs into the example above and let me find them. Reveal each answer only after I have guessed.
Answer in English. Keep code examples in Security. Where you are unsure, say so.