Turn Claude Code into a senior teammate

The change

// src/orders.js
async function listOrders(req, res) {
  const status = req.query.status;
  const orders = await db.query(
    `SELECT * FROM orders
     WHERE status = '${status}'`);
  for (const o of orders) {
    o.items = await db.query(
      'SELECT * FROM items WHERE order_id = $1',
      [o.id]);
  }
  const total = orders.reduce(
    (s, o) => s + o.amount, 0.0);
  res.json({ orders, total });
}

The review

Verdict: 🛑 Request changes

🛑 Blocking
1. SQL injection - src/orders.js:12
   Scenario: GET /orders?status=' OR '1'='1
   returns every order.
   Fix: use a parameterized query, as
   getOrder does.

2. Missing authorization: returns other
   users' orders - src/orders.js:12
   The query has no user_id filter. getOrder
   checks it, listOrders skips that check.

⚠️ Should fix
3. N+1 queries - src/orders.js:13-15
   5,000 matching orders means 5,001
   sequential round trips.

4. Money summed as floats - src/orders.js:16
   Sum in SQL or use integer cents.

👍 Good
The items query on line 14 is parameterized
correctly.