Back to Code | Ep 10: The Security Vulnerability Factory

The 15-week technical battle of LogiFlow — a company waking up from the illusion created by artificial intelligence and returning to real engineering.

The Story

AI directly inserted the user-entered "Truck Plate Number" into a SQL query and HTML template. The doors to XSS and SQL Injection were opened.

It was a penetration tester who found it. During a routine security audit, she typed '; DROP TABLE trucks; -- into the plate number search field. The query executed. The table survived only because the database user didn't have DROP permissions — a lucky accident, not a design decision.

Technical Autopsy: AI's Innocent Trap

// AI uses string interpolation — DISASTER
const query = `SELECT * FROM trucks WHERE plate = '${userInput}'`;
await db.query(query);
// userInput: "'; DROP TABLE trucks; --"

AI generates code that works. It fulfills the functional requirement: "search trucks by plate number." The code compiles, the tests pass (because the tests use clean data), and the feature ships.

But AI doesn't think adversarially. It doesn't imagine a user typing malicious SQL into a form field. It doesn't consider that the same input rendered in HTML could execute JavaScript in another user's browser.

The Human Shield

// Safe: Parameterized query
const query = `SELECT * FROM trucks WHERE plate = $1`;
await db.query(query, [userInput]);

For XSS prevention:

// Never render raw user input in HTML
// ❌ Dangerous
element.innerHTML = userInput;

// ✅ Safe
element.textContent = userInput;

// Or use a sanitization library
import DOMPurify from 'dompurify';
element.innerHTML = DOMPurify.sanitize(userInput);

Security is not a feature AI can "add later." It's a foundation of the architecture.

Lessons from Episode 10

1. Parameterized Queries: Never write SQL with string interpolation.

2. Input Validation: Every external input must be validated and sanitized at the boundary gate.

3. Security Review: Every piece of AI-generated code must be manually reviewed for security vulnerabilities.

---

This is Episode 10 of the "Back to Code" series. Next up: Episode 11 — The Legacy Code Mine.

Series: back.to.code · 2026