On that note, I had latest Claude Opus xhigh write me some code.

If a user passed an empty string to the user_id field it would give them access to everyone’s data. How that worked was a check like “if user_id: # add user id to query”. Empty strings are falsy in Python, so empty user id retrieves all data.

A function later on was filtering these results out coincidentally, but not specifically. So if this shipped, in a month when someone updated the code, we’d be allowing an empty login form to access all user data.

This is the slop getting shipped by AI code assistants. This is why I am rewriting the whole project manually.