An agent is tasked with refactoring authentication middleware for a financial services application. The agent rewrites token validation, session handling, and role-based access control logic. Before the refactored code is released to production, which evaluation technique is MOST critical for this specific task?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Think of authentication middleware as the vault door of your application — you do not just check whether the door opens and closes, you inspect every bolt, hinge, and lock mechanism for weaknesses. The correct answer is C: SAST scans the source code itself, catching hardcoded secrets, broken crypto, and injection paths that functional tests are blind to. Performance (A), UAT (B), and linting (D) are all useful but none of them find security flaws baked into the code logic.
Full explanation below image
Full Explanation
Authentication middleware is one of the highest-risk surfaces in any application: it controls who gets in, what they can do, and how sessions are managed. When an AI agent refactors this code, the evaluation strategy must prioritize security analysis above all other signals.
Why C is correct: Static Application Security Testing (SAST) analyzes source code without executing it, tracing data flows to detect vulnerability patterns. For auth middleware specifically, SAST tools like CodeQL, Semgrep, or Checkmarx flag: hardcoded API keys or passwords the agent may have copied from training data, use of deprecated or broken cryptographic functions (MD5, SHA-1 for passwords), missing input sanitization that creates SQL injection or LDAP injection paths, and logic errors in role checks that allow privilege escalation. These classes of vulnerability are invisible to functional tests because the tests only verify that valid credentials succeed and invalid credentials fail — they do not probe the security of the implementation itself.
Why A is wrong: Performance benchmarking measures latency and throughput. A middleware that responds in 5ms but uses a breakable cipher is catastrophically worse than one that takes 10ms and uses AES-256-GCM. Latency is a secondary concern after security correctness.
Why B is wrong: UAT confirms that the user-facing login flow works from an end-user perspective. A QA engineer logging in successfully through the UI provides zero signal about whether the token signing key is properly protected, whether session fixation is possible, or whether the RBAC logic contains a bypass.
Why D is wrong: Linting enforces code style conventions — indentation, naming, import order. Style compliance has no relationship to security correctness. Code can be beautifully formatted and catastrophically insecure at the same time.
For agent-generated security-critical code, the evaluation pipeline should sequence: SAST first, then functional tests, then performance, then style.