Security defaults that belong in every FastAPI application from day one.
93
90%
Does it follow best practices?
Impact
98%
7.00xAverage score across 5 eval scenarios
Passed
No known issues
A retail company is building an internal inventory management system. The engineering team needs a backend REST API built from scratch with FastAPI. The API will be consumed by an internal web dashboard hosted on a different domain. The API will be deployed to a cloud environment and must be production-ready from the first release -- there is no separate hardening phase before go-live.
The API supports basic inventory operations: listing products, adding a new product, and updating the stock level for an existing product. Products have a name (text), a SKU code (short alphanumeric string), a quantity on hand (whole number), and a category that must be one of: electronics, clothing, food, or furniture.
Produce a single Python file named main.py containing a complete, runnable FastAPI application with:
GET /products -- list all products (return a stub list)POST /products -- add a new product (accepts a request body model)PATCH /products/{sku}/stock -- update stock quantity for a productInclude a if __name__ == "__main__": block that starts the server with uvicorn. Stub out any database calls -- returning placeholder data is fine. All imports must be present and the file must be valid Python.
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
fastapi-security-basics
verifiers