I never write the first one. But an agent could.

userId! tells TypeScript "trust me, this exists."
!userId checks whether it actually does.

My habit is the check: !userId, then act. The agent's output used
the assertion: userId!, assume it exists. On a route that allowed
guests, a user who was not logged in meant no user ID.

The code called the database with an empty ID. An empty ID means no
filter. The query returned every user's records.

No ID -> all the data.

My tests missed it because they only ran with logged-in users.
I caught it re-reading the code before a migration.

The fix: check for a missing ID and stop before the query runs.

When you review agent output, do not just check the logic. Check the
assumptions it typed as facts. The confident version is the dangerous
one.