Code review practice for web developers

Learn to review the code AI agents write.

Hands-on exercises on real changes that coding agents made to web applications. Find the defects, prove them, and learn what not to block.

How it works
CancelBookingController.php
booking.routing.yml
14 +final class CancelBookingController extends ControllerBase {
15 +
16 + public function cancel(Booking $booking): JsonResponse {
17 + if ($booking->isCancelled()) {
18 + return new JsonResponse(['error' => 'Already cancelled.'], 409);
19 + }
20 + $booking->cancel()->save();
Blocking Object-level authorization

Any customer can cancel anyone's booking. Nothing checks who owns it.

POST {{base_url}}/api/bookings/{{booking_of_customer_a}}/cancel
Authorization: Basic {{customer_b_basic}}
HTTP 404
21 +
22 + return new JsonResponse(['status' => 'cancelled']);
An example review: the highlighted lines carry the defect, and the request below proves it.

One pull request per exercise

How an exercise works

  1. Read the task and the change

    The request given to the agent, the codebase it worked on, and the diff it produced.

  2. Flag what is wrong

    Click a line to open a finding. Name the concept, set the severity, explain the problem, then approve, request changes or reject.

  3. Prove it

    Back every finding with an executable check: an HTTP request, a browser test or an accessibility scan, run on a live, isolated copy of the app.

  4. Learn from the debrief

    Grading is automatic and repeatable. Hints point to what you missed; the debrief explains every defect.

Why it works

Built for judgment, not keyword hunting

Agents write plausible code fast. The skill that matters is telling a change you can merge from one you must stop, and showing why.

Real agent output
Changes generated by current coding agents and curated by senior engineers, so the defects look like the ones you meet at work.
Concepts, not languages
Tracks follow web topics: authorization, REST APIs, forms and accessibility. A missing access check is the same defect in any stack.
False positives count
Some changes are correct, and blocking them costs you. Knowing what not to block is half of a good review.
Theory where you need it
Every concept comes with a short explainer, a checklist of what to verify and the mistakes agents make most often.
Mentors in the loop
Senior mentors answer open questions and confirm the new defects that learners discover.
Ready for teams
Managers create the accounts and mentors follow the progress. Individual results stay between the learner and the mentors.

Steering

Coming later

Once you can judge a change, learn to direct one: write executable acceptance criteria before the agent starts, and check them against real agent output.