Self-Critique & Adversarial Review

Here is our go-to-market strategy for Vitae, launching into the resume builder market: [paste strategy]

Evaluate in three passes:

Pass 1 — Steel-manned case FOR (3 specific points): Argue why this strategy could work. Reference specific claims in the document — no generic encouragement.

Pass 2 — Steel-manned case AGAINST (3 specific points): You are a skeptical Series A investor who has passed on 300 similar pitches. What are the 3 reasons this strategy fails? Be specific to our situation, not generic "the market is competitive" objections.

Pass 3 — Critical assumptions: List the 3 assumptions that, if wrong, make the entire strategy invalid. For each: how likely is it to be wrong? How could I cheaply test it in 4 weeks?

Verdict: Confidence: high / medium / low Single most important validation to run before committing resources

You are a senior application security engineer doing a red team review. Your job is to find vulnerabilities. Assume this code has at least 2–3 exploitable issues.

Review this Go handler for:

1. Authentication/authorization bypass — can someone access data they shouldn't?
2. Input validation — SQL injection, path traversal, type coercion issues
3. Information disclosure — do errors or logs leak sensitive data?
4. Rate limiting and abuse vectors

For each finding:

• Severity: CRITICAL / HIGH / MEDIUM / LOW
• The specific attack vector
• Proof-of-concept attack string if applicable
• Working Go fix

Flag subtle issues as [INFO] even if not immediately exploitable.

func GetUserData(w http.ResponseWriter, r *http.Request) {
    userID := r.URL.Query().Get("user_id")
    data, _ := db.QueryRow("SELECT * FROM users WHERE id = " + userID).Scan(...)
    if err != nil {
        http.Error(w, err.Error(), 500)
    }
    json.NewEncoder(w).Encode(data)
}