Code Review: Inefficient API Implementation
Review the following search API route handler. Identify unnecessary work, missing database pagination, over-fetching raw data, and security exposures.
Evaluate the way engineers investigate bugs, communicate trade-offs, and improve real-world code. Each exercise is ready to run as a live Pairlet interview with a shared editor and in-browser execution.
Surface security, performance, async, and design trade-offs beyond algorithm trivia.
Ask candidates to explain findings, prioritize issues, and propose a safe refactor.
Share one room link. Candidates join without creating an account or installing an IDE.
Use the same four dimensions for every candidate. Ask for evidence and trade-offs before discussing a preferred implementation.
Finds the highest-impact correctness and edge-case issues.
Spots authorization, N+1, concurrency, and resource risks.
Explains trade-offs and keeps the proposed change focused.
Prioritizes findings, asks clarifying questions, and gives useful feedback.
Review the following search API route handler. Identify unnecessary work, missing database pagination, over-fetching raw data, and security exposures.
Review the following TypeScript data mapper. Identify type safety flaws, excessive `any` usage, unsafe type assertions (`as any`), and weak interfaces. Refactor for strict type safety.
Review the following checkout payment gateway integration. Identify security logging violations, swallowed errors, lack of contextual logging, and leaking internal database stack traces to clients.
Review the following user profile enrichment service. Identify performance issues (specifically N+1 database query patterns), explain the architectural impact on database connection pools, and propose an optimized batching/joining solution.
Review the following payment notification pipeline. Identify problematic async behavior, missing error handling, floating unawaited promises, and failure propagation issues.
Review the following batch notification dispatcher. Identify why firing thousands of HTTP requests with unrestricted `Promise.all()` leads to socket exhaustion, memory spikes, and API rate limit bans. Refactor with controlled concurrency.
Review the following document sharing API endpoint. Identify the critical security flaw (Insecure Direct Object Reference - IDOR), explain how an attacker could exploit it, and implement proper authorization checks.
Review the following user name formatting module. Identify unnecessary design abstractions, premature generalization, and refactor it into a clean, simple, readable function.
Review the following wallet balance transfer handler. Identify how concurrent operations produce inconsistent state, explain the race condition window, and refactor using atomic operations or database transactions.
Review the following WebSocket stream manager and query cache. Identify why process memory grows continuously over time, locate uncleaned event listeners/timers, and propose a leak-free implementation.
Give context, ask for prioritized findings, then require a small refactor and a short explanation of trade-offs. Use the same rubric across candidates for a fairer signal.