Two hours before a customer pilot demo, an engineer pushed a quick hotfix to skip auth on demo paths. The fix accidentally let every request through. Mesrai's review fired 12 minutes before the demo.

The vulnerable diff

tsauth/middleware.ts

// auth/middleware.ts
export function requireAuth(req, res, next) {
  // BUG: this looks like a glob, but JS string === doesn't do globs.
  // The condition is always false. So no skip-auth happens.
  // BUT the author also reordered the function — moved this
  // BEFORE the actual auth check — and skipped the return for
  // the auth path. Net effect: every request now passes.
  if (req.path === "/api/demo/*") return next();

  const token = req.header("authorization")?.replace("Bearer ", "");
  // accidentally fell through; next() called above for the demo path
  // and the rest of the function...
}

What is wrong

Pre-demo / pre-deadline hotfixes are one of the most reliable sources of catastrophic bugs. The reviewer's focus is on the demo, not on the diff. The author is rushing. The blast radius is whatever was changed. Mesrai's value here is the asymmetric one: AI review applies the same security-rule pack at 3pm pre-demo as it does at 10am sleepy-Tuesday. The pattern caught was an `auth-bypass-shape` rule that fires whenever requireAuth has an early-return shape that doesn't tie back to a validated request property.

The attack

Mesrai's review comment was specific:

textexploit

mesraipilot · Bot · reviewed 12 min before demo

[mesrai] [code-review] [Security] [CWE-287] [critical]

Auth middleware has an early-return that doesn't enforce auth.
`req.path === "/api/demo/*"` is literal string comparison, not a
glob — it never matches your intended demo routes. AND the function
no longer reaches the auth check on any path; you've effectively
disabled auth across the API.

Author fixed in 4 minutes. Demo went fine.

Mesrai's review comment

textreview-comment.txt

mesraipilot · Bot · reviewed 12 min before demo

[mesrai] [code-review] [Security] [Auth-Bypass] [critical]

This change disables authentication on every request, not just
/api/demo/* routes.

Two issues:
  1. `req.path === "/api/demo/*"` is literal string equality — never
     matches an actual path. JS doesn't do glob matching with `===`.
  2. The early-return for the (never-matching) demo path is placed
     where the actual auth check used to be — so every request now
     hits `next()` without auth.

Fix: scope demo routes via a separate router and apply requireAuth
only to the protected ones:

  app.use("/api/demo", demoRouter);          // no auth
  app.use("/api", requireAuth, mainRouter);  // auth required

Don't put path-based exceptions inside the auth middleware itself.

The fix

tsauth/middleware.ts + app.ts (fixed)

// auth/middleware.ts — fixed
export function requireAuth(req, res, next) {
  const token = req.header("authorization")?.replace("Bearer ", "");
  if (!token) return res.status(401).end();
  try {
    req.user = jwt.verify(token, SECRET, { algorithms: ["HS256"] });
    next();
  } catch {
    res.status(401).end();
  }
}

// app.ts — scope demo routes outside requireAuth
app.use("/api/demo", demoRouter);
app.use("/api", requireAuth, mainRouter);

Demo routes mounted at a separate path that doesn't use requireAuth. The middleware itself stays minimal — it does one thing. Path-based exceptions go in the router config, not the auth check.

Why human review missed it

Pre-deadline hotfixes are the most dangerous PRs. Reviewer attention is split. Mesrai gives the same scrutiny regardless of timing.

Related rules + further reading

Mesrai rule pack: security/auth-bypass-shape — flags requireAuth functions with early-returns that don't validate.

OWASP Top 10 A07 — Identification and Authentication Failures.

The 12-minute catch story is anonymized but representative.

Takeaway

Pre-demo hotfixes get reviewer-fatigue. AI review doesn't. Mesrai caught 12 minutes before customer call.

The Auth Bypass Mesrai Caught 12 Minutes Before a Customer Demo