An AI code review answers one question: is this code safe to put in front of real users, and will you be able to change it in six months? Those are different from "does it run", which is the only question that has been tested so far.
A normal code review compares a change against the intentions of the person who wrote it. With generated code there was no such person, and often no consistent intention — each file was written against whatever context existed in that moment.
So the review has to look at different things. Not style, not naming, not whether a function could be three lines shorter. What matters is whether the pieces agree with each other, whether the assumptions holding it together are true, and whether anything in it will be expensive or dangerous later.
These are the categories that come up again and again in AI-assisted codebases, roughly in order of how often they turn out to matter.
Endpoints that check whether you are logged in, but not whether this record is yours. This is the single most common serious finding, and it is usually a two-line fix once someone notices.
The shape one part sends and the shape another expects have drifted. It works for the paths that were tested and fails for the rest.
Errors caught and swallowed, so problems accumulate invisibly instead of surfacing while they are still small.
Queries with no index, loops that call an API once per row, no pagination. Fine at demo scale, quietly fatal at real scale.
The same logic implemented in three places. Today they agree. After the next change, one of them won't.
Yes, and it’s a good moment to ask. A pre-launch review covers architecture, security, performance, dependencies and maintainability, and comes back as a prioritized list rather than a wall of comments.
Yes, as an engineering review rather than a formal audit or certification. I look at authentication, authorization, exposed secrets, input handling, dependency risk and what your deployment leaves open. If you need a certified penetration test, I’ll tell you that instead of pretending otherwise.
Usually not. Rewriting is the most expensive option and it’s rarely the one the code actually calls for. I’d rather find the specific things that are broken and fix those.
The service
The code works. That's a different question from whether it's safe to put in front of users, and a different question again from whether you'll be able to change it in six months.
Working is not production ready. Twelve checks: backups, authorization, secrets, error visibility, rate limits and rollback — and what each costs if skipped.
Read
10 min read
Review generated code by risk, not by file: authorization and data writes first, six greps for common failures, and the seams where pieces meet.
Read
9 min read
Sometimes it needs an engineer.
Send the messy version. That’s usually the useful version.