On 2 November I posted the first free "bug of the week": a small task app, one bug, solved in the browser. Here is how it worked, why the obvious fix is the wrong one, and what bug #2 is.

The setup

Tasklane is a fictional task app for small teams. You are signed in as Sam, a regular member.

GET /api/me returns your profile, including "role": "member" .

The profile form lets you change one thing: your display name.

GET /api/admin/users answers 403 admin_only .

The goal was to get that admin list as Sam.

The bug, in three requests

1. Read the baseline. GET /api/me shows more fields than the form does: id , name , email , role , team . That is the hint. The form only sends name , but the record has a role .

2. Send a field the form never sends.

PATCH / api / me Content - Type : application / json

{ "name" : "Sam Lee" , "role" : "admin" }

Enter fullscreen mode

Exit fullscreen mode

The response comes back with "role": "admin" . The server saved it.

3. Check the impact.…