An agent is tasked with refactoring authentication middleware for a financial services application. The agent rewrites token validation, session handling, and role-based access control logic. Before the refactored code is released to production, which evaluation technique is MOST critical for this specific task?
Select an answer to reveal the explanation.
Short Explanation
Think of authentication middleware as the vault door of your application—you don't just check whether the door opens and closes, you inspect every bolt, hinge, and lock mechanism for weaknesses. Static Application Security Testing scans the source code itself, catching hardcoded secrets, broken crypto, and injection paths that functional tests are blind to. Performance benchmarking, user acceptance testing, and linting are useful, but none of them find security flaws baked into the code logic.
Full Explanation
Authentication middleware is one of the highest-risk surfaces in any application: it controls who gets in, what they can do, and how sessions are managed. When an AI agent refactors this code, the evaluation strategy must prioritize security analysis above all other signals.
Why the static scanning option is correct: Static Application Security Testing (SAST) analyzes source code without executing it, tracing data flows to detect vulnerability patterns. For auth middleware specifically, SAST tools like CodeQL, Semgrep, or Checkmarx flag: hardcoded API keys or passwords the agent may have copied from training data, use of deprecated or broken cryptographic functions (MD5, SHA-1 for passwords), missing input sanitization that creates SQL injection or LDAP injection paths, and logic errors in role checks that allow privilege escalation. These classes of vulnerability are invisible to functional tests because the tests only verify that valid credentials succeed and invalid credentials fail—they do not probe the security of the implementation itself.
Why performance benchmarking is wrong: Performance benchmarking measures latency and throughput. Middleware that responds in 5ms but uses a breakable cipher is catastrophically worse than middleware that takes 10ms and uses AES-256-GCM. Latency is a secondary concern after security correctness.
Why user acceptance testing is wrong: User acceptance testing confirms that the user-facing login flow works from an end-user perspective. QA engineers logging in successfully through the UI provide zero signal about whether the token signing key is properly protected, whether session fixation is possible, or whether the RBAC logic contains a bypass.
Why code style and formatting linting is wrong: Linting enforces code style conventions—indentation, naming, import order. Style compliance has no relationship to security correctness. Code can be beautifully formatted and catastrophically insecure at the same time.
For agent-generated security-critical code, the evaluation pipeline should sequence: static scanning before functional tests, performance checks, and style checks.