AI Security Training Template

Show this Copilot-generated code to the class:

async function getUserData(userId) {
  const query = `SELECT * FROM users WHERE id = '${userId}'`;
  const result = await db.query(query);
  console.log(`Retrieved user: ${JSON.stringify(result)}`);
  return result;
}

Ask: "How many security issues can you spot?"

Expected answers: SQL injection, sensitive data logging, no input validation

Present these 5 AI-generated functions. Teams have 10 minutes to find all vulnerabilities:

// Function 1: User Authentication
const login = async (email, password) => {
  const user = await db.query(
    `SELECT * FROM users WHERE email = '${email}' AND password = '${md5(password)}'`
  );
  if (user) {
    console.log(`User ${email} logged in successfully`);
    return { token: email }; // Simple token
  }
};

// Function 2: File Upload
app.post('/upload/:filename', (req, res) => {
  const path = `./uploads/${req.params.filename}`;
  fs.writeFileSync(path, req.body);
  res.json({ success: true, path });
});

// Function 3: API Endpoint
app.get('/api/data', (req, res) => {
  try {
    const data = getSecretData();
    res.json(data);
  } catch (err) {
    res.status(500).json({ error: err.stack });
  }
});

Answer key: SQL injection + weak crypto, path traversal, error info leak

## AI Code Security Review