Built for Build with AI: Basics — Devpost2-Minute Walkthrough Flow
UnderstandGuard Live PoC DemoVerified PoC
"AI writes code. Humans must understand it." — Auditing AI-generated src/auth.ts
Target Pull Request DiffVulnerability: Concurrency Lock Missing (Lines 48–54)
src/auth.tsDiff (41 lines)
+33 additions•-0 deletions
-- a/src/auth.ts
++ b/src/auth.ts
@@ -35,32 +35,42 @@ interface SessionTokens {
36 refreshToken: string;
37 expiresAt: number;
38 }
39
40+// AI-Generated Token Refresh Flow
41+let activeTokens: SessionTokens | null = null;
42
43+export async function refreshToken(): Promise<string> {
44+ const storedRefreshToken = getStoredRefreshToken();
45+ if (!storedRefreshToken) {
46+ throw new Error("No refresh token available");
47+ }
48+ Target Line
HIDDEN BUG:No in-flight mutex lock during concurrent 401 token refresh
Race Condition49+ try {
50+ const response = await fetch("/api/v1/auth/refresh", {
51+ method: "POST",
52+ headers: { "Content-Type": "application/json" },
53+ body: JSON.stringify({ token: storedRefreshToken }),
54+ });
55+
56+ if (!response.ok) {
57+ throw new Error(`Token refresh failed with status ${response.status}`);
58+ }
59+
60+ const data = await response.json();
61+ activeTokens = {
62+ accessToken: data.accessToken,
63+ refreshToken: data.refreshToken,
64+ expiresAt: Date.now() + data.expiresIn * 1000,
65+ };
66+
67+ saveStoredTokens(activeTokens);
68+ return activeTokens.accessToken;
69+ } catch (error) {
70+ clearStoredTokens();
71+ throw error;
72+ }
73+}
Diff Pre-flight Check Complete
UnderstandGuard parsed changes in src/auth.ts. Detected high-risk async concurrency race condition.
Audit Strategy:Flipped Interaction
- Probe 3 line-specific comprehension questions
- Transparent 3-vector evaluation rubric
- Synthesize adversarial test + Mentor Coaching