Checkpoint: Security Engineering

The exam question: the same feature ships twice — once with authorization derived from the session, once with the owner id accepted from the request body. Both pass every functional test. Which one gets your customers breached?

The checkpoint challenge is that judgment, mechanized: given handler records, decide clean vs vulnerable vs critical — the exact triage a security reviewer performs in the first five minutes of an audit.