Building Fast with Claude Code Is Easy. Securing the App Is the Hard Part

用 Claude Code 快速构建应用很容易，但确保其安全性才是难点

Disclosure Full disclosure: I currently intern at Perfai Security, the authorization and access control testing platform mentioned later in this article. This isn’t a sponsored post—I genuinely built FlashDraft as a personal project, and because I work at Perfai, I naturally used it as part of my release process. If you think either the app or Perfai could be improved, I’d genuinely appreciate your honest feedback.

披露 完全披露：我目前在 Perfai Security 实习，这是一家在本文稍后提到的授权与访问控制测试平台。这不是一篇赞助文章——我确实是出于个人项目目的构建了 FlashDraft，而且因为我在 Perfai 工作，我自然而然地将其作为我发布流程的一部分。如果您认为该应用或 Perfai 有改进空间，我非常欢迎您提供诚恳的反馈。

The Problem AI coding tools make it possible to generate dashboards, databases, authentication flows, and API routes faster than ever. But a working application is not automatically a secure application. This becomes especially important when an app has multiple users, private data, ownership rules, and different permission levels. A user may be signed in correctly but still gain access to another user’s information or perform actions they should not be allowed to perform. I wanted to explore both sides of AI-assisted development: how quickly I could build a real multi-user application and how I could verify its authorization before calling it complete.

问题所在 AI 编程工具使得生成仪表板、数据库、身份验证流程和 API 路由的速度比以往任何时候都快。但一个能运行的应用并不等同于一个安全的应用。当应用涉及多用户、私有数据、所有权规则和不同的权限级别时，这一点尤为重要。用户可能已正确登录，但仍可能访问其他用户的信息或执行其本不应被允许的操作。我想探索 AI 辅助开发的两个方面：我能多快构建一个真正的多用户应用，以及在宣布项目完成前，我该如何验证其授权机制。

Using Claude Code, I built FlashDraft, a one-week fantasy soccer platform with league commissioners, members, site administrators, private draft boards, trades, rosters, and league-specific controls. This article is less about the fantasy game itself and more about what I learned while building quickly with AI, defining permissions, and testing the deployed application for authorization problems.

我使用 Claude Code 构建了 FlashDraft，这是一个为期一周的梦幻足球平台，包含联赛专员、成员、网站管理员、私有选秀板、交易、花名册和联赛特定控制功能。本文重点不在于梦幻游戏本身，而在于我在利用 AI 快速构建、定义权限以及测试已部署应用的授权问题时所学到的经验。

The Project FlashDraft is a short-format fantasy soccer application where users create leagues, draft players, manage rosters, and compete for one week. The application has three main roles: Site administrators manage the overall platform. League commissioners manage the leagues they create. League members manage their own teams, lineups, trades, and private draft information.

项目介绍 FlashDraft 是一款短周期梦幻足球应用，用户可以在其中创建联赛、挑选球员、管理花名册并进行为期一周的比赛。该应用有三个主要角色：网站管理员管理整个平台；联赛专员管理他们创建的联赛；联赛成员管理他们自己的球队、阵容、交易和私有选秀信息。

These roles created the main technical challenge. Authentication could confirm who a user was, but the application still needed to determine which leagues, teams, settings, and actions that user was authorized to access. For example, a member should be able to edit their own lineup but not another member’s lineup. A commissioner should be able to manage their own league but not a league created by someone else. A private draft board should remain private even from other members in the same league. Those permission boundaries became one of the most important parts of the project.

这些角色带来了主要的技术挑战。身份验证可以确认用户身份，但应用仍需确定该用户有权访问哪些联赛、球队、设置和操作。例如，成员应该能够编辑自己的阵容，但不能编辑其他成员的阵容。专员应该能够管理自己的联赛，但不能管理他人创建的联赛。私有选秀板即使对同一联赛的其他成员也应保持私密。这些权限边界成为了项目中最重要的部分之一。

Tech Stack FlashDraft was built using: Claude Code, TypeScript, Prisma ORM, PostgreSQL, Tailwind CSS, Clerk Authentication, Neon Database, Vercel. Claude Code generated much of the application’s foundation, including: Database models, Dashboards, API routes, League workflows, Authentication flows. Clerk handled authentication, while Prisma and Neon managed users, leagues, rosters, trades, draft selections, and league settings.

技术栈 FlashDraft 使用了以下技术：Claude Code、TypeScript、Prisma ORM、PostgreSQL、Tailwind CSS、Clerk 身份验证、Neon 数据库和 Vercel。Claude Code 生成了该应用的大部分基础架构，包括：数据库模型、仪表板、API 路由、联赛工作流和身份验证流程。Clerk 处理身份验证，而 Prisma 和 Neon 则负责管理用户、联赛、花名册、交易、选秀选择和联赛设置。

Testing the Authorization Model Building an application that works is only half the challenge. FlashDraft stores user accounts, league memberships, team ownership, private draft strategies, trades, lineups, and league settings. If authorization is implemented incorrectly, one user could potentially view or modify information belonging to someone else. I began by testing the application manually with multiple accounts, roles, and leagues.

测试授权模型 构建一个能运行的应用只是挑战的一半。FlashDraft 存储了用户账户、联赛成员资格、球队所有权、私有选秀策略、交易、阵容和联赛设置。如果授权实现不当，一个用户可能会查看或修改属于他人的信息。我首先通过多个账户、角色和联赛对应用进行了手动测试。

I checked whether: A member could access another member’s team; A member could edit another user’s lineup; A commissioner could manage a league they did not create; A non-member could access a private league; One user could view another user’s private draft board; A user could manipulate IDs inside requests; Sensitive API responses exposed unnecessary data; Admin and commissioner permissions remained separate.

我检查了以下情况：成员是否能访问其他成员的球队；成员是否能编辑其他用户的阵容；专员是否能管理非其创建的联赛；非成员是否能访问私有联赛；一个用户是否能查看另一个用户的私有选秀板；用户是否能在请求中篡改 ID；敏感的 API 响应是否暴露了不必要的数据；管理员和专员的权限是否保持独立。

This type of testing is important because normal user flows only confirm that allowed actions work. Authorization testing also asks whether forbidden actions are properly blocked. After completing the manual checks, I submitted the deployed application to Perfai Security. Perfai tested the running application’s authorization and access-control behavior. The goal was not simply to review whether the code looked correct. It was to validate whether users could access only the resources and actions they were permitted to use.

这种测试非常重要，因为常规用户流程只能确认允许的操作是否有效。授权测试则进一步确认禁止的操作是否被正确拦截。完成手动检查后，我将已部署的应用提交给了 Perfai Security。Perfai 对运行中的应用的授权和访问控制行为进行了测试。其目的不仅仅是检查代码看起来是否正确，而是验证用户是否只能访问他们被授权使用的资源和操作。

This mattered because authorization bugs often appear across the boundaries between users, roles, resources, and API endpoints. No automated tool can guarantee that an application is completely secure. However, testing the deployed product can help identify access-control weaknesses that may be missed during rapid AI-assisted development. Because I currently intern at Perfai Security, I naturally used it as part of my release process.

这一点至关重要，因为授权漏洞往往出现在用户、角色、资源和 API 端点之间的边界处。没有任何自动化工具能保证应用绝对安全。然而，测试已部署的产品有助于识别在快速 AI 辅助开发过程中可能被遗漏的访问控制弱点。由于我目前在 Perfai Security 实习，我自然而然地将其作为我发布流程的一部分。

How I Built It with Claude Code FlashDraft began as a detailed product prompt inside Claude Code. I first defined the main roles, resources, and workflows. These included users, leagues, teams, rosters, drafts, trades, league settings, and private draft boards. Claude Code then helped generate much of the application foundation, including: Database models, Prisma relationships, Authentication flows, API routes, Dashboards, League workflows, UI components.

我是如何用 Claude Code 构建它的 FlashDraft 最初是 Claude Code 中的一个详细产品提示词。我首先定义了主要角色、资源和工作流，包括用户、联赛、球队、花名册、选秀、交易、联赛设置和私有选秀板。随后，Claude Code 帮助生成了应用的大部分基础架构，包括：数据库模型、Prisma 关系、身份验证流程、API 路由、仪表板、联赛工作流和 UI 组件。

This dramatically reduced the time required to create boilerplate and connect the major parts of the application. However, generating the structure was only the beginning. I still needed to decide who owned each resource, which roles could perform each action, and where authorization needed to be enforced on the server. AI was effective at producing code quickly, but it could not replace the product decisions behind the permission model.

这极大地减少了创建样板代码和连接应用主要部分所需的时间。然而，生成结构仅仅是个开始。我仍然需要决定谁拥有每个资源，哪些角色可以执行哪些操作，以及在服务器的什么位置强制执行授权。AI 在快速生成代码方面非常有效，但它无法取代权限模型背后的产品决策。

The biggest lesson was that AI-generated code should be treated as a strong first draft, not automatically trusted as production-ready.

最大的教训是：AI 生成的代码应被视为一份强有力的初稿，而不是直接被视为可用于生产环境的成品。