# Spot the bug: Symfony

> One snippet. Find the bug, or prove there isn't one.

Daily challenge: 2026-08-19 (UTC) · Mid-Level

```php
<?php

namespace App\Controller;

use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\Routing\Attribute\Route;

class OrderController extends AbstractController
{
    #[Route('/api/getOrders', methods: ['GET'])]
    public function list(OrderRepository $repo): JsonResponse
    {
        return new JsonResponse($repo->findAll());
    }

    #[Route('/api/deleteOrder/{id}', methods: ['GET'])]
    public function delete(int $id, OrderRepository $repo): JsonResponse
    {
        $repo->delete($id);
        return new JsonResponse(['status' => 'ok']);
    }
}

```

## Your verdict

- Security flaw
- Logic bug
- Code style
- No issue

One attempt per day. The answer shows up right after.

---

Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack.
HTML version of this page: https://sharpskill.dev/en/daily/symfony