Putting models to the secure coding test: Plan vs default mode

This research-tested three coding models (Sonnet 5, Composer 2.5, GPT 5.5) in default and plan modes to generate a document-portal web app, then audited the outputs with Supply Chain Firewall, Datadog Code Security, and a code-review skill. Across six implementations the most severe recurring issue was an insecure direct object reference (IDOR) allowing authenticated users to access others’ documents; other high-risk findings included a hardcoded JWT secret enabling authentication forgery, leaked password-reset tokens, MIME-spoofable uploads and Content-Disposition injection, cookie misconfiguration, and missing token revocation. Plan mode produced some architectural hardening in places but did not eliminate the critical authorization gap; the report concludes that clearer functional requirements (e.g., “documents must be visible only to their owner”) are necessary for models to generate secure authorization logic.