Two kinds of bugs only exist outside your laptop: the ones created by the environment around the app, and the ones created by people who are not you. The skill this section trains is checking what the app assumes about both.

The proxy is part of the environment

Behind a gateway the service is often mounted under a path prefix that the proxy strips before forwarding. The app learns the prefix as root_path (uvicorn's --root-path) and needs it only for URLs it hands back to the browser, such as the OpenAPI document that the docs page fetches. Built-in FastAPI routes handle that; a hand-written URL like /openapi.json does not. Test it the way the proxy sees it: TestClient(app, root_path="/api"), with more than one prefix so a hard-coded value cannot pass.

Authentication is not authorization

A valid token says who is calling, not what they may touch. An endpoint that takes an id from the URL must scope the query to the caller (WHERE id = :id AND customer_id = :me) so that somebody else's id is indistinguishable from a missing one. Sequential ids make the missing check trivially exploitable (an insecure direct object reference), but random ids only make it harder to guess, not safe. Test with two users: the owner gets the object, the stranger gets a 404.