Self-Critique & Adversarial Review

Here is our go-to-market strategy for Vitae, launching into the resume builder market: [paste strategy] Evaluate in three passes: Pass 1 — Steel-manned case FOR (3 specific points): Argue why this strategy could work. Reference specific claims in the document — no generic encouragement. Pass 2 — Steel-manned case AGAINST (3 specific points): You are a skeptical Series A investor who has passed on 300 similar pitches. What are the 3 reasons this strategy fails? Be specific to our situation, not generic "the market is competitive" objections. Pass 3 — Critical assumptions: List the 3 assumptions that, if wrong, make the entire strategy invalid. For each: how likely is it to be wrong? How could I cheaply test it in 4 weeks? Verdict: Confidence: high / medium / low Single most important validation to run before committing resources

You are a senior application security engineer doing a red team review. Your job is to find vulnerabilities. Assume this code has at least 2–3 exploitable issues. Review this Go handler for: 1. Authentication/authorization bypass — can someone access data they shouldn't? 2. Input validation — SQL injection, path traversal, type coercion issues 3. Information disclosure — do errors or logs leak sensitive data? 4. Rate limiting and abuse vectors For each finding: - Severity: CRITICAL / HIGH / MEDIUM / LOW - The specific attack vector - Proof-of-concept attack string if applicable - Working Go fix Flag subtle issues as [INFO] even if not immediately exploitable. ```go func GetUserData(w http.ResponseWriter, r *http.Request) { userID := r.URL.Query().Get("user_id") data, _ := db.QueryRow("SELECT * FROM users WHERE id = " + userID).Scan(...) if err != nil { http.Error(w, err.Error(), 500) } json.NewEncoder(w).Encode(data) } ```