What Code Review Can't See (and Bad Data Always Finds)
Code review is good at inspecting intent. It's structurally blind to a specific class of bugs - the ones where valid-looking data exposes wrong assumptions across layers. Here's why, and what complements review for input boundaries.
Opening excerpt (first ~120 words) tap to expand
What Code Review Can't See (And Bad Data Always Finds) April 30, 2026 20 min read testing api code-review debugging security backend api-testing Introduction The bug was not subtle. It was quite trivial after it was discovered. A tenant could see another tenant’s data. The path had the correct tenant. The authenticated user had the correct tenant. The UI never sent the wrong value. The controller even looked clean in review. The problem was the query to the database. Somewhere between the service call and the repository, the code was filtering by tenantId from the path instead of the tenantId resolved from the auth context. Both values were present. Both looked reasonable in isolation. The query was just trusting the wrong one.
…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Dochia.
Discussion
0 commentsMore from Dochia
