Check: security of AI-written code

Goal: Confirm you can keep secrets out of code, spot a missing authorization check, and vet a dependency an agent suggests.

Four questions: three on this module, one on Module 4. Every answer explains itself, right or wrong.

An agent moves a key into process.env.API_KEY and compares it with a request header. The variable isn't set on the server. What can happen?The app refuses to startA request without the header gets inIt falls back to the old hard-coded key

PATCH /api/notes/:id updates a note by ID. The code checks the user is signed in, then saves. What's missing?AuthenticationA check that the note belongs to the callerInput validation on the note text

Your ComputeSphere app needs a payment provider key. Where does the value live?In a config file in the repositoryIn a ComputeSphere secret on the service, and in .env on your machineIn the agent's chat, so it can set it up for you

From Module 4: reviewing an agent's diff, you see a new package in package.json that the brief didn't ask for. What is it?A scope change: ask why, and check the package before accepting itA routine detail you can skipFine, as long as the tests pass

Retry as often as you like.