The scenario
Repair a community directory response so storage metadata and private contact fields stay private.
A failure to reason about
Use a small security scenario to compare the current behavior with the intended service behavior.
Illustrative context for the topic. The exercise’s full requirements arrive in the workspace.
Questions to bring to your review
- Which caller makes the reported behavior visible?
- What focused regression would distinguish the current behavior from the requirement?
- What existing behavior must remain intact after the change?
Skills you will practice
- Public response contracts
- Field allowlists
- Nested projection
- Regression testing
Read the existing code, reproduce the reported behavior, review proposed changes, and verify your final implementation. You can use AI assistance while staying responsible for the result.
Prepare with a worked example
- How to review AI-generated code
A worked review of a cache patch: establish the contract, find a counterexample, verify the fix, and explain the evidence.
See how nrml evaluates an attempt, including the limits of automated evidence.