DRAFT[PLACEHOLDER: DATE]· ~8 MIN· SECURITY · TESTING · AI CODE

Deliver code you have proven to work

There are two steps to proving a piece of code works. Neither is optional — and it matters more now that an agent wrote most of it.

The bar moved

[PLACEHOLDER: OPEN WITH THE 2026 SHIFT — ONCE AGENTS WRITE MOST OF THE CODE, HAND-WRITTEN VOLUME PROVES LITTLE. WHAT PROVES CAPABILITY IS REASONING MADE VISIBLE AND CODE PROVEN TO WORK. 1–2 PARAGRAPHS IN YOUR VOICE.]

Step one · manual testing

[PLACEHOLDER: IF YOU HAVEN'T SEEN THE CODE DO THE RIGHT THING YOURSELF, IT DOESN'T WORK. WALK THROUGH A CONCRETE MANUAL TEST YOU RAN — WHAT YOU CLICKED, WHAT YOU EXPECTED, WHAT YOU SAW.]

Step two · tests that fail on revert

An automated test only counts if it fails when the change is reverted. Here's the shape — generic, no real schema:

test('rejects cross-tenant read', async () => {
  const res = await client
    .from('records').select().eq('tenant', OTHER_TENANT);
  // fails the moment the RLS policy is reverted
  expect(res.data).toHaveLength(0);
});

[PLACEHOLDER: EXPLAIN WHY THIS TEST IS LOAD-BEARING — IT ENCODES THE SECURITY PROPERTY, NOT JUST THE HAPPY PATH. TIE IT TO YOUR RLS / AUTH-MIDDLEWARE WORK.]

The security review

[PLACEHOLDER: NARRATE A CLASS OF AUTHZ BUG YOU CAUGHT IN AGENT-WRITTEN CODE — RECONSTRUCTED GENERICALLY, NEVER THE REAL SCHEMA. WHAT THE AGENT WROTE, WHY IT WAS WRONG, HOW YOU FOUND IT, WHAT YOU CHANGED, THE TEST THAT NOW GUARDS IT.]

Knowing what's security-adjacent — and refusing to outsource it — is the skill.

Why this is the signal

[PLACEHOLDER: CLOSE ON THE HIRING SIGNAL — PROVING YOU CAN READ, DEBUG, AND SECURE AGENT OUTPUT IS A 2026 DIFFERENTIATOR WHEN MADE LEGIBLE. LINK BACK TO THE WORK.]

ALL WRITING DISCUSS THIS →