AI-generated code is not insecure because the model writes bad code. It's insecure because security lives in the relationships between pieces of code, and each piece was generated without knowledge of the others. The same few vulnerabilities show up over and over.
In roughly the order they turn up when someone reads an AI-built codebase for the first time.
Every endpoint verifies that you're logged in. Very few verify that the record you asked for belongs to you. Incrementing an ID in a URL is all it takes to find out.
An API key in a frontend bundle is public regardless of what it's named. A key committed once stays in git history even after the file is deleted — and history is what gets cloned.
Client-side validation is a convenience for honest users. Anyone can post directly to your API, and generated backends frequently trust whatever arrives.
Prices, roles, quantities and user IDs read from the request body rather than from the session. If the browser can set it, treat it as hostile.
None of these require a security background.
This is an engineering security review: someone reading your code and your configuration for the categories of mistake that actually cause incidents at your stage. It's the right thing for most small teams and pre-launch products.
It is not a certified penetration test, and it isn't a compliance audit. If you need SOC 2, ISO 27001, or a signed pen-test report for a customer, you need a specialist firm — and I'd rather tell you that plainly than sell you something adjacent.
Yes, as an engineering review rather than a formal audit or certification. I look at authentication, authorization, exposed secrets, input handling, dependency risk and what your deployment leaves open. If you need a certified penetration test, I’ll tell you that instead of pretending otherwise.
Yes, and it’s a good moment to ask. A pre-launch review covers architecture, security, performance, dependencies and maintainability, and comes back as a prioritized list rather than a wall of comments.
Yes. If something is broken for real users right now, say so when you get in touch and I’ll treat it accordingly. I’ll want access to logs and the deployment, not just the code.
The service
The code works. That's a different question from whether it's safe to put in front of users, and a different question again from whether you'll be able to change it in six months.
Working is not production ready. Twelve checks: backups, authorization, secrets, error visibility, rate limits and rollback — and what each costs if skipped.
Read
10 min read
The eight security problems that recur in AI-generated apps, from missing ownership checks to leaked secrets — with a fix and a test for each one.
Read
10 min read
Sometimes it needs an engineer.
Send the messy version. That’s usually the useful version.