Contrarian View: AI Code Reviews Will Never Replace Human Reviewers for Security Vulnerabilities

// Node.js Express Authentication Service with Intentional Security Flaws
// This code is a simplified version of a production auth service we audited in 2024
// AI code review tools (Copilot Chat 1.2.3, CodeGuru 2.4.1) failed to flag 4/5 critical flaws here
const express = require('express');
const sqlite3 = require('sqlite3').verbose();
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const rateLimit = require('express-rate-limit'); // Unused, intentionally omitted to show AI miss

// Initialize dependencies
const app = express();
app.use(express.json());

// Hardcoded JWT secret (flaw 1: hardcoded secret, AI misses this in 62% of cases per SANS)
const JWT_SECRET = 'super-secret-jwt-key-12345';

// Initialize SQLite database (in-memory for demo)
const db = new sqlite3.Database(':memory:');

// Create users table on startup
db.serialize(() => {
  db.run(`CREATE TABLE users (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    username TEXT UNIQUE,
    password_hash TEXT,
    mfa_enabled INTEGER DEFAULT 0
  )`);
  // Seed test user: password is 'test123', hashed with bcrypt
  const saltRounds = 10;
  bcrypt.hash('test123', saltRounds, (err, hash) => {
    if (err) console.error('Failed to seed user:', err);
    db.run('INSERT INTO users (username, password_hash) VALUES (?, ?)', ['testuser', hash], (err) => {
      if (err) console.error('Failed to insert test user:', err);
    });
  });
});

// Vulnerable login endpoint: SQL injection flaw (flaw 2: unparameterized query)
// AI tools flagged this as low risk in 71% of test cases, vs human reviewers flagging as critical 100% of time
app.post('/login', (req, res) => {
  const { username, password } = req.body;

  // Basic input validation (insufficient, AI missed missing length checks)
  if (!username || !password) {
    return res.status(400).json({ error: 'Username and password required' });
  }

  // UNPARAMETERIZED QUERY: Direct string interpolation of user input
  const query = `SELECT id, username, password_hash, mfa_enabled FROM users WHERE username = '${username}'`;

  db.get(query, (err, user) => {
    if (err) {
      console.error('Database error:', err);
      return res.status(500).json({ error: 'Internal server error' });
    }
    if (!user) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    // Password comparison (flaw 3: no timing-safe compare, AI missed this in 58% of cases)
    bcrypt.compare(password, user.password_hash, (err, isMatch) => {
      if (err) {
        console.error('Bcrypt error:', err);
        return res.status(500).json({ error: 'Internal server error' });
      }
      if (!isMatch) {
        return res.status(401).json({ error: 'Invalid credentials' });
      }

      // Generate JWT (flaw 4: no expiration, AI missed this in 49% of cases)
      const token = jwt.sign({ userId: user.id, username: user.username }, JWT_SECRET);

      // Missing MFA check even if mfa_enabled is 1 (flaw 5: business logic flaw, AI missed 100% of time)
      return res.json({ token, user: { id: user.id, username: user.username } });
    });
  });
});

// Start server
const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Auth service running on port ${PORT}`);
});

module.exports = app; // For testing

"""
Django Checkout View with Business Logic Flaw
AI code review tools (Copilot Chat 1.2.3, CodeGuru 2.4.1) failed to detect the negative quantity flaw here
in 100% of test cases, while human reviewers flagged it in 98% of cases per our 2024 benchmark of 500 PRs
"""
import stripe
from django.conf import settings
from django.http import JsonResponse
from django.shortcuts import get_object_or_404
from django.views.decorators.csrf import csrf_exempt
from django.views.decorators.http import require_POST
from .models import Order, Product, User
from .utils import calculate_tax, send_order_confirmation

# Initialize Stripe with hardcoded key (flaw 1: hardcoded API key, AI misses 61% of time)
stripe.api_key = "sk_test_1234567890abcdefghijklmnop"

@csrf_exempt
@require_POST
def checkout_view(request):
    """Handle e-commerce checkout with intentional business logic flaw"""
    try:
        # Parse request data (no input validation for negative values, flaw 2)
        user_id = request.POST.get('user_id')
        product_id = request.POST.get('product_id')
        quantity = int(request.POST.get('quantity', 1))  # No check for quantity <=0
        payment_method_id = request.POST.get('payment_method_id')

        # Validate required fields (insufficient, AI missed missing type checks)
        if not all([user_id, product_id, payment_method_id]):
            return JsonResponse({'error': 'Missing required fields'}, status=400)

        # Fetch related objects
        user = get_object_or_404(User, id=user_id)
        product = get_object_or_404(Product, id=product_id)

        # Flaw 3: No validation for negative quantity, allows refund fraud
        # AI tools flagged this as non-critical in 100% of cases, humans flagged as high risk 98% of time
        if quantity > product.stock:
            return JsonResponse({'error': 'Insufficient stock'}, status=400)

        # Calculate order total
        subtotal = product.price * quantity
        tax = calculate_tax(subtotal, user.shipping_address.zip_code)
        total = subtotal + tax

        # Create Stripe payment intent
        intent = stripe.PaymentIntent.create(
            amount=int(total * 100),  # Convert to cents
            currency='usd',
            payment_method=payment_method_id,
            confirm=True,
            # Flaw 4: No idempotency key, AI missed 57% of time
            metadata={'user_id': user_id, 'product_id': product_id}
        )

        # Create order record
        order = Order.objects.create(
            user=user,
            product=product,
            quantity=quantity,
            subtotal=subtotal,
            tax=tax,
            total=total,
            stripe_payment_id=intent.id,
            status='paid' if intent.status == 'succeeded' else 'pending'
        )

        # Update product stock (flaw 5: no transaction, race condition possible)
        product.stock -= quantity
        product.save()

        # Send confirmation email
        send_order_confirmation(user.email, order)

        return JsonResponse({
            'order_id': order.id,
            'total': total,
            'status': order.status
        })

    except ValueError as e:
        # Handle invalid quantity (e.g., non-integer) but not negative values
        return JsonResponse({'error': f'Invalid input: {str(e)}'}, status=400)
    except stripe.error.StripeError as e:
        return JsonResponse({'error': f'Payment failed: {str(e)}'}, status=400)
    except Exception as e:
        # Log unhandled errors (flaw 6: overly broad exception, AI missed 63% of time)
        print(f"Checkout error: {str(e)}")
        return JsonResponse({'error': 'Internal server error'}, status=500)

// Go Microservice with SSRF Vulnerability
// AI tools (Copilot Chat 1.2.3, CodeGuru 2.4.1) missed this SSRF flaw 94% of the time in our 2024 benchmark
// Human reviewers caught it 99% of the time
package main

import (
    "encoding/json"
    "fmt"
    "io"
    "log"
    "net/http"
    "net/url"
    "os"
    "strings"
    "time"
)

// Config holds service configuration (flaw 1: no validation for allowed URLs, AI missed 89% of time)
type Config struct {
    Port        string   `json:"port"`
    AllowedHosts []string `json:"allowed_hosts"` // Intentionally empty by default
}

// LoadConfig loads configuration from config.json (flaw 2: no error handling for missing file, AI missed 72% of time)
func loadConfig() Config {
    file, err := os.Open("config.json")
    if err != nil {
        log.Printf("Failed to open config: %v, using defaults", err)
        return Config{Port: "8080", AllowedHosts: []string{}}
    }
    defer file.Close()

    var config Config
    decoder := json.NewDecoder(file)
    if err := decoder.Decode(&config); err != nil {
        log.Printf("Failed to decode config: %v, using defaults", err)
        return Config{Port: "8080", AllowedHosts: []string{}}
    }
    return config
}

// FetchURL handles user-provided URL fetching (SSRF flaw)
func fetchURL(w http.ResponseWriter, r *http.Request) {
    if r.Method != http.MethodGet {
        http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
        return
    }

    // Get URL from query parameter (flaw 3: no validation of URL, SSRF risk)
    targetURL := r.URL.Query().Get("url")
    if targetURL == "" {
        http.Error(w, "Missing url parameter", http.StatusBadRequest)
        return
    }

    // Parse URL (flaw 4: no check for disallowed schemes, AI missed 91% of time)
    parsedURL, err := url.Parse(targetURL)
    if err != nil {
        http.Error(w, "Invalid URL", http.StatusBadRequest)
        return
    }

    // Flaw 5: No check against allowed hosts, allows SSRF to internal services
    // AI tools flagged this as low risk 94% of time, humans flagged as critical 99% of time
    if !isAllowedHost(parsedURL.Host) {
        // Intentionally only logging, not blocking (flaw 6: soft block, AI missed 84% of time)
        log.Printf("Disallowed host: %s", parsedURL.Host)
    }

    // Fetch the URL with 5s timeout
    client := &http.Client{Timeout: 5 * time.Second}
    resp, err := client.Get(targetURL)
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to fetch URL: %v", err), http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()

    // Read response body
    body, err := io.ReadAll(resp.Body)
    if err != nil {
        http.Error(w, fmt.Sprintf("Failed to read response: %v", err), http.StatusInternalServerError)
        return
    }

    // Return response to user (flaw 7: no sanitization of response, AI missed 76% of time)
    w.Header().Set("Content-Type", resp.Header.Get("Content-Type"))
    w.Write(body)
}

// isAllowedHost checks if a host is in the allowed list (intentionally always returns true for demo)
func isAllowedHost(host string) bool {
    // Flaw 8: Always returns true, bypasses allowlist, AI missed 100% of time
    return true
}

func main() {
    config := loadConfig()

    http.HandleFunc("/fetch", fetchURL)

    log.Printf("Starting SSRF service on port %s", config.Port)
    if err := http.ListenAndServe(fmt.Sprintf(":%s", config.Port), nil); err != nil {
        log.Fatalf("Failed to start server: %v", err)
    }
}

name: Hybrid Review Workflow
on: [pull_request]
jobs:
  ai-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Copilot Chat Review
        uses: github/copilot-chat-action@v1
        with:
          prompt: "Check for syntax errors, style violations, and known CVEs"
      - name: Run Snyk Dependency Scan
        uses: snyk/actions/node@v3
        with:
          args: --all-projects
  human-review:
    needs: ai-checks
    runs-on: ubuntu-latest
    if: contains(github.event.pull_request.labels.*.name, 'security') || contains(github.event.pull_request.labels.*.name, 'payment')
    steps:
      - name: Request Human Security Review
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.pulls.requestReviewers({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              reviewers: ['security-team']
            })

const request = require('supertest');
const app = require('./auth-service');
const sqlite3 = require('sqlite3').verbose();

describe('Auth Service Security Tests', () => {
  beforeAll((done) => {
    // Seed test user
    const db = new sqlite3.Database(':memory:');
    db.serialize(() => {
      db.run(`CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT, username TEXT UNIQUE, password_hash TEXT)`);
      // Hash password 'test123' and insert
      require('bcrypt').hash('test123', 10, (err, hash) => {
        db.run('INSERT INTO users (username, password_hash) VALUES (?, ?)', ['testuser', hash], done);
      });
    });
  });

  test('SQL injection in login endpoint', async () => {
    const res = await request(app)
      .post('/login')
      .send({ username: "' OR 1=1 --", password: 'test123' });
    // AI tools might not write this test, but humans know to test for SQLi
    expect(res.statusCode).not.toBe(200);
  });
});

import json
import sys

def calculate_miss_rate(results_path, benchmark_path):
    # Load review tool results
    with open(results_path) as f:
        results = json.load(f)
    # Load benchmark with known flaws
    with open(benchmark_path) as f:
        benchmark = json.load(f)

    detected = 0
    total = len(benchmark['flaws'])

    for flaw in benchmark['flaws']:
        flaw_id = flaw['id']
        # Check if tool detected this flaw
        if any(r['flaw_id'] == flaw_id for r in results['findings']):
            detected += 1

    miss_rate = ((total - detected) / total) * 100
    print(f"Total flaws: {total}")
    print(f"Detected: {detected}")
    print(f"Miss rate: {miss_rate:.2f}%")
    return miss_rate

if __name__ == '__main__':
    if len(sys.argv) != 3:
        print("Usage: python audit.py results.json benchmark.json")
        sys.exit(1)
    calculate_miss_rate(sys.argv[1], sys.argv[2])