- Treat AI-written code like code from a new junior developer: useful, but it needs review.
- Run it, test it with bad input and check for exposed secrets and missing permissions.
- Use automated tests and a second pair of eyes for anything important.
The Short Answer
AI tools can produce working code in seconds, but working is not the same as safe or correct. AI-written code can contain logic errors, outdated methods, invented functions and security mistakes such as hard-coded passwords or missing input checks. The fix is not to avoid AI. It is to review and test its output carefully, using the same habits good developers use on any new code.
Step 1: Understand What It Does
Ask the AI to explain the code line by line and summarise what changed. If you cannot follow part of it, ask for a simpler version. Do not ship code you cannot explain to someone else.
Step 2: Run It and Try to Break It
- Run the happy path, then test empty fields, very long text, wrong file types and strange characters.
- Try large numbers, zero and negative values.
- Test on a phone and a computer if it has a screen.
- Ask the AI to write tests, then read the tests to make sure they check something real.
Step 3: Check Security
| Check | What to look for |
|---|---|
| Secrets | Passwords, API keys or tokens written directly in the code or committed to a repository |
| Input handling | User input used without checking, which can enable injection attacks |
| Permissions | Pages or data open to people who should not see them |
| Dependencies | Packages that are unknown, outdated or misspelled copies of real ones |
| Error messages | Messages that reveal internal details to users |
Step 4: Use Tools and a Second Opinion
Run a linter and a security scanner, keep your work in version control (see Git and GitHub for beginners) and ask another person to review important changes. You can also ask a different AI tool to review the code and list risks, then verify each point yourself.
Step 5: Plan for Problems
Keep backups, make small releases and know how to roll back. Our 3-2-1 backup rule and security checklist are good habits to follow.
Action Checklist
- Ask for an explanation of every change
- Run normal and abnormal test cases
- Search for hard-coded secrets
- Check user input and permissions
- Review new dependencies
- Use version control and keep backups
- Get a human review for important code
