How to check AI-generated code before you ship it

You can meaningfully check AI-generated code without reading it line by line: what you need is a checklist that targets the specific ways AI code fails. Those failures are predictable: leaked secrets, misplaced trust in user input, and confident claims about untested behavior. Here's the pre-ship pass, in order of how badly each miss hurts.

1. Hunt for secrets in the code

The most expensive AI coding mistake is also the most common: pasting secret keys (Stripe keys, database passwords, API tokens) directly into code files instead of environment configuration. Code gets shared, published, and pushed to GitHub, and bots scan public GitHub for keys within minutes. Ask your agent directly:

Search this entire project for hardcoded secrets: API keys,
passwords, tokens, database URLs. List every finding with the
file name. Then move them to environment variables and confirm
the .env file is in .gitignore.

If a key was ever committed to git history, moving it isn't enough. Treat it as burned and rotate it (generate a new one at the provider and revoke the old). This check alone justifies the whole checklist.

2. Check where the app trusts strangers

AI-generated code habitually trusts input: it assumes the email field contains an email, the quantity is a positive number, and the person requesting account #42's data is the owner of account #42. Every place your app accepts input from the internet (forms, URLs, uploads) is a place someone will eventually feed it something hostile. The prompt:

Review every place this app accepts user input or serves
user-specific data. For each: does it validate the input on
the server, and does it verify the requester is allowed to
see that data? List the gaps before fixing anything.

The phrase “on the server” matters. AI code often validates in the browser only, which is decoration, since anyone can bypass the browser and talk to your server directly.

3. Walk the paths that cost money

Behavior checks beat code checks, and some behavior deserves manual verification every time: anything involving payments, sign-ups, or data deletion. Walk each one like a user (pay with a test card, create an account, delete a record) and then check the other side (did the payment actually land in Stripe? is the deleted record actually gone?). The agent saying “the checkout flow is implemented” and money actually moving are different facts, and only one of them matters.

4. Force a self-review, then a plain-language recap

Two prompts finish the pass. First: “Review everything that changed for security vulnerabilities and mistakes. List what you find before fixing.” A second look catches a surprising share of first-pass mistakes: asking for the list first stops silent half-fixes. Then: “Explain what changed in plain language, as if to a non-technical business owner.” If any explanation doesn't hold together, you found where to dig. You're not reviewing code at this point. You're reviewing whether the person who wrote it can account for it, which is what code review mostly is.

How often do you actually do this?

Scale it to the stakes. A hobby page for friends: check for secrets and move on. Anything with user accounts: the full pass before every real release. Anything handling payments or personal data: the full pass, plus a professional security review before launch: a few hundred dollars against the cost of apologizing to every user you have. The point of the checklist isn't paranoia; it's that ten minutes of checking, at the right moments, buys you the confidence the “just ship it” crowd only pretends to have.