AI-generated code security
AI-Generated Code Security Checklist
AI can get an app working quickly. Before real users rely on it, verify that the code enforces the security controls a polished interface cannot prove. Use this checklist before every launch.
0 OF 18 COMPLETE
Progress is saved only in this browser.
Check 01
Keep secrets out of browser code
Generated apps often work because a token was placed where the browser can read it. Treat every value shipped to the client as public.
Check 02
Verify authorization on every data action
Authentication answers who is making a request. Authorization answers whether that person may read, change, or delete this exact record.
Check 03
Validate inputs at the server boundary
Client-side validation improves the experience but is not a security control. Attackers can call an API route directly with a crafted body.
Check 04
Treat payments and webhooks as hostile input
A completed screen in the browser is not proof of payment. Payment access must be based on provider-verified server data.
Check 05
Limit abuse before expensive work begins
AI-generated routes often call a model, email provider, payment provider, or database without an abuse boundary. That can become a bill or an outage.
Check 06
Review deployment controls before launch
A secure route can still be exposed by a permissive deployment configuration, weak browser headers, or an unreviewed environment variable.
Ready for a second review?
Run a security scan before launch.
Use this checklist to guide your review, then scan the code for findings you may have missed. VibeCheck returns an ephemeral report with severity, exploit paths, and suggested fixes.