Can Your Eye Spot All 4 Bugs?
This Supabase profile update endpoint has four real defects, two of them critical. Try to find them, then read the dual-AI review of the same code.
The code under review
A POST /update-profile endpoint that writes email and role straight from the request body, logs raw errors, and then calls the Supabase admin auth API to load the user.
Reviewer 1 — initial analysis
- Critical — unauthorized role escalation: role is taken from req.body and written without validation, so any user can promote themselves.
- Warning — sensitive error logging: logging the raw database error can expose internal detail.
- Warning — missing input validation: the email field is never validated.
Reviewer 2 — verification and additional findings
- Confirmed all three findings above.
- Critical — Supabase service-role exposure, missed by the first reviewer: supabase.auth.admin.getUserById() uses the service role from a user-facing endpoint.
Result for this example
Four findings in total on this snippet, two of them critical, one of which only the second reviewer caught. That second pass is the reason the product exists.
Frequently asked questions
Is this a real review?
Yes. It is the output of the same review pipeline the product runs, on the code shown on the page.
Can I run this on my own code?
Yes. The free analyzer on the homepage reviews pasted code without an account.
Free plan available. No credit card required.