How to use Codex to review registration security
Codex independently reviewed event registration and found actor-identity gaps, an overbooking race and a privileged SQL boundary before human acceptance.
note.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Review this event-registration specification, plan and diff independently. Trace authenticated actor identity through server actions and database filters; test concurrent capacity reservations; inspect SECURITY DEFINER search paths. Return reproducible findings and proposed regressions, then recheck the revised implementation before human acceptance.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- リヴァイアちゃん (@shachitomodachi)
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The author reports incorporating 29 review findings and completing 254 tests, with concrete authorization and transactional-capacity fixes before acceptance.
- Human involvement
- The author directed the review loop and retained final tests, diff review and acceptance; the reported merge and test total were not independently reproduced.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Codex reviewed the registration specification, plan and diff independently of Claude Code’s implementation.
- The review identified missing trusted actor propagation, a capacity-check race and a privileged-function search-path issue.
- Claude Code incorporated fixes, including transactional registration, before the author’s final test and diff review.
The author behind @shachitomodachi paired Claude Code implementation with independent Codex CLI reviews of an event-registration feature. Codex inspected the specification, implementation plan and final diff instead of merely checking the finished interface.
Three findings make the account useful. A rule allowing members to cancel only their own registrations lacked a trusted actor identifier across the use case and server action. The review called for deriving that identity server-side and constraining the database operation. A separate capacity check followed by insertion created an overbooking race; the implementation moved both operations into a Supabase RPC transaction protected by an advisory lock. A privileged database function also needed an explicit search path.
Claude Code incorporated review feedback while the author retained final test and diff review. The account reports 29 findings incorporated, 254 tests, and a merged first pull request. Those are the author’s reported results; a public repository merge was not independently verified.
The agent’s role here was adversarial review, while a different agent performed implementation. The concrete human checkpoint was accepting changes only after tests and another review of the revised work. The source demonstrates specific authorization and concurrency repairs, without establishing a production penetration-test result.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: note · リヴァイアちゃん (@shachitomodachi)
Frequently asked questions
Which agent implemented the feature?
Claude Code implemented it; Codex CLI supplied independent specification, plan and diff reviews.
How was overbooking addressed?
The account describes a Supabase RPC combining capacity checking and insertion under an advisory lock.
Was the public merge independently verified?
No. The source reports a merged pull request, but this case relies on the author’s published account.
More details
About this account
Codex reviewed the registration specification, plan and diff independently of Claude Code’s implementation. The review identified missing trusted actor propagation, a capacity-check race and a privileged-function search-path issue.
Firsthand Japanese account opened and read. Codex is the reviewing agent, Claude Code the implementer. Counts and merge are author-reported; no independent production audit or public-merge verification is claimed. Suggested prompt written by Agents In Use; no original task prompt was found in the verified text.
Credit: リヴァイアちゃん (@shachitomodachi) — note
Source published
Added to Agents In Use
Source checked
Tools and topics
Codex CLI · Claude Code · Next.js · Supabase · PostgreSQL
independent review · authorization · transaction races
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.