Five checks before AI-written code meets real users
The demo works, the first customers are coming. Five quick checks catch most of the problems AI-built apps ship with.
Priya Raman · Automate & Scale · · 2 min read
AI is very good at the happy path. It writes the code for a user who fills every field correctly, owns every record they ask for and never clicks twice. Real users do all of those things, and so do people who are not users at all.
The five checks
- Every request checks who is asking. Open a record that belongs to another account by changing the ID in the URL. If it loads, you have an authorisation bug.
- No secrets in the browser. Search the built JavaScript for your API keys. Keys for paid services belong on the server only.
- Inputs are validated on the server. Client-side validation is a convenience, not protection.
- Errors reach you. Install error tracking and trigger a test error. If you don't get the alert, neither will you in production.
- You can roll back. Know the exact command or button that restores the previous version, and try it once before you need it.
Tip: Ask a second model to attack your code
Paste a route handler into a different model and ask how a malicious user would abuse it. It won't find everything, but it finds the obvious holes in seconds.
Then make the checks automatic
A checklist you run by hand gets skipped on the busy day. Type checks, tests and a dependency audit in CI run on every change, whoever — or whatever — wrote it.
