Work through the difficult parts.

Model choice, selected context and readable answers, without configuring a project before your first question.

reports.ts

Find the access-control flaw in this endpoint. Show the smallest fix and a regression test.

Authorization check

A valid report ID is not authorization.

The lookup checks which report exists, but never checks who owns it. Bind the query to the authenticated tenant and test that a second tenant cannot read it.

Inspect the original snippet

typescript

const report = await db.reports.findUnique({
  where: { id: request.params.id }
});

Proposed change

typescript

const report = await db.reports.findFirst({
  where: {
    id: request.params.id,
    tenantId: session.tenantId
  }
});

Files close to the question.

Choose reference files explicitly. Source records preserve provenance, and deleting a source removes derived responses under the documented deletion policy.

Data handling

Review the actual action.

When a governed tool is proposed, inspect its exact inputs. Your approval of those inputs authorizes the action. Model output does not grant permission.

Tools and approvals

Modes grow with verified execution.

Chat uses the configured catalog. Code checks and static Reverse analysis use isolated runners; bounded Pentest HTTP checks require an available gateway and explicit authorized scope.

Current capability boundaries

Choose your interface.

Use the browser, downloadable CLI and SDK, VS Code extension, or native API contracts. Client packages are versioned direct downloads with SHA-256 checksums.

Developer documentation