How Do You Audit AI-Generated Code?
Auditing AI-generated code requires a different methodology than auditing human-written code. AI tools produce consistent failure patterns — the same classes of bugs appear across every project, every language, and every framework. Knowing what to look for makes the audit faster and more thorough.
Start With the Data Flow
Map every path from user input to database write, external API call, or file system operation. AI-generated code often has missing validation or sanitization steps along these paths. Follow every input: where does it go, what transforms it, what checks it, and where does it end up? Any path where user-controlled data reaches a database query, shell command, or template render without sanitization is a vulnerability.
Review Authentication From the Outside In
Start at the routes/endpoints layer and work backwards. For every protected route: what exactly checks authentication? What checks authorization (is this user allowed to do this)? Test each check mentally: what happens if the token is missing, expired, tampered with, or belongs to a different user? AI tools frequently add authentication checks but skip authorization checks — the code confirms you are logged in but not that you are allowed to access this specific resource.
Look for the AI Shortcut Patterns
AI tools consistently take certain shortcuts: string concatenation in SQL queries instead of parameterized queries, console.log or print statements left in production code that leak internal state, hardcoded fallback values for environment variables ('if not API_KEY: API_KEY = dev_key_here'), try/except blocks that silently swallow errors, and CORS configurations set to '*' during development and never tightened.
Test the Authorization Boundary
Create two test accounts and log in as user A. Then try to read, modify, and delete user B's data by changing IDs, guessing URLs, or manipulating API parameters. AI-generated resource endpoints are routinely missing the 'does this user own this resource' check — they confirm you are logged in but not that the resource belongs to you.
Scan the Git History
AI coding assistants frequently suggest hardcoding secrets during setup and often the developer commits this before moving to environment variables. Scan the full git history for secrets, not just the current HEAD. A secret committed and then removed is still in the history — and still compromised.
Use Static Analysis — But Don't Stop There
Tools like Semgrep, Bandit (Python), ESLint security rules, and Snyk catch the mechanical issues: known vulnerable patterns, dependency CVEs, obvious injection vectors. But the most damaging bugs in vibe-coded apps are logic bugs — missing permission checks, broken state machines, race conditions — that static analysis cannot detect. A human expert reading the code in context is required.
When to Hire a Professional
DIY audits using this methodology catch the obvious issues. A professional auditor brings: experience with the specific failure patterns of the AI tool you used, deep knowledge of industry-specific compliance requirements, payment processor security experience, and the ability to think like an attacker. Most serious vulnerabilities in vibe-coded apps are found by professionals because they know where to look.