The scenario
Redact nested credentials without damaging ordinary event data.
A failure to reason about
A credential nested inside an event object reaches the log while a harmless field with a similar name is removed.
Illustrative context for the topic. The exercise’s full requirements arrive in the workspace.
Questions to bring to your review
- Which caller makes the reported behavior visible?
- What focused regression would distinguish the current behavior from the requirement?
- What existing behavior must remain intact after the change?
Skills you will practice
- Security
- Recursive transforms
- URL encoding
Read the existing code, reproduce the reported behavior, review proposed changes, and verify your final implementation. You can use AI assistance while staying responsible for the result.
Prepare with a worked example
- How to review AI-generated code
A worked review of a cache patch: establish the contract, find a counterexample, verify the fix, and explain the evidence.
See how nrml evaluates an attempt, including the limits of automated evidence.