AI assistants write code quickly, and they also reproduce common mistakes quickly. Studies and security teams have repeatedly found that generated code can include insecure patterns, so a review step is not optional. Use this checklist before AI-assisted code reaches a client.
1. Input validation and injection
Check every place user input reaches a database, shell command, file path or template. Use parameterised queries and validate on the server, not only in the browser.
2. Authentication and session handling
Confirm passwords are hashed with a modern algorithm, sessions expire, tokens are stored safely and password reset flows cannot be abused.
3. Authorisation
Logging in is not the same as being allowed. For every endpoint, test that one user cannot read or change another user’s data by changing an ID.
4. Secrets and configuration
Search the codebase and history for API keys, passwords and tokens. Move them to environment variables or a secrets manager and rotate anything that was ever exposed.
5. Dependencies
Verify that every package exists, is maintained and is needed. AI tools sometimes suggest packages that are outdated or that do not exist, which attackers can exploit. Run a vulnerability scan and pin versions.
6. Data protection
Encrypt data in transit, protect sensitive fields at rest, avoid logging personal information and confirm backups are encrypted and tested.
7. Error handling and logging
Errors should never expose stack traces or internal details to users, and security-relevant events such as failed logins should be logged.
8. Security headers and configuration
Check HTTPS, cookie flags, CORS rules, rate limiting and the content security policy.
9. File uploads
Restrict types and sizes, store files outside the web root and scan where appropriate.
10. A human sign-off
Someone accountable should read the risky parts of the diff and approve the release. Automated scanners help, but they do not replace judgement.
The takeaway
Treat AI-generated code as untrusted until reviewed. If you would like an independent security pass on a build before it goes live, we offer it as part of our delivery process. Related reading: our guide to vibe coding review.
How to hire Outsorcerer as your technical partner
Want an independent security review before an AI-assisted build goes live? We audit, fix and harden code as part of delivery, and hand you a clean report you can share with your client.
- Step 1: Book a free 15-minute call. Tell us the project, the market and the deadline. No generic quote, no sales script.
- Step 2: Get a scoped proposal. Fixed scope for a one-off build, or a monthly retainer for ongoing work. Regional pricing is on the Services page.
- Step 3: Start with a pilot. One small, real deliverable so you can judge our communication, quality and turnaround first.
- Step 4: Scale into a retainer. Your brand stays in front, our team stays behind it.
Book a free 15-minute call or contact us here if you’d rather write first.
