AI code security checklist before launch
Use this checklist after building with an AI coding tool and before connecting real customers, payments, or sensitive data.
Start with the highest-impact failures
AI-generated code is still ordinary code. The most urgent risks usually involve exposed credentials, missing server-side authorization, overly broad database access, and trusted inputs that an attacker can control.
1. Remove exposed secrets
Search browser-delivered code, commits, logs, and screenshots for API keys, service-role keys, database URLs with credentials, and access tokens. Rotate a secret if it was ever public—deleting it is not enough.
2. Enforce authorization on the server
Signing in proves identity, not permission. Every admin, billing, export, delete, and account-management route should independently verify the user and required role on the server.
3. Lock down database access
Enable Row Level Security where appropriate, test policies as multiple user types, and make sure public or anonymous clients cannot read or change another user’s records.
4. Keep private work off the client
Payment operations, privileged database calls, secret-backed AI requests, and admin actions belong behind server routes. Return only fields the browser actually needs.
5. Validate inputs and webhooks
Validate request shapes, reject unexpected fields, verify webhook signatures, and rate limits, and make retries safe so one event cannot create duplicate actions.
6. Check dependencies and deployment settings
Review known dependency advisories, production environment variables, CORS rules, cookie flags, error messages, source maps, and preview deployments.
7. Test the fix
Re-run the exact risky path after changing code. Confirm the old exploit or exposure is gone without weakening authentication, breaking normal users, or leaking details through a new response.
What an automated scanner cannot prove
No scanner can verify every business rule or guarantee an app is secure. Combine automated checks with manual role testing, backups, staging, monitoring, and professional review when the impact warrants it.