Why AI Code Audits Are Different

When I audit human-written code, I’m looking for mistakes. When I audit AI-generated code, I’m looking for shortcuts.

AI doesn’t make typos in security logic. It makes architectural decisions that prioritize getting something working over getting it secure. The auth system works, but it’s checking the wrong thing. The API responds, but it’s not validating who’s asking.

The audit process I use focuses on these systematic issues rather than random bugs.

The Audit Framework

Phase 1: Reconnaissance

Before reading code, understand what the AI built.

Questions to answer:

• What tool generated this? (Lovable, Cursor, Claude Code, Bolt)
• What frameworks did it choose?
• Where does user data flow?
• What’s the authentication mechanism?

Each AI tool has signature patterns. Lovable defaults to Supabase with specific auth configurations. Cursor tends toward whatever’s in the context window. Claude Code follows your existing patterns if you have any, invents them if you don’t.

Phase 2: High-Value Target Review

Start with the code that matters most:

1. Authentication flows — Login, signup, password reset, session management
2. Authorization checks — Who can access what
3. Payment processing — Stripe integration, billing logic
4. Data access — Database queries, API calls
5. File handling — Uploads, downloads, processing

Don’t read the entire codebase. AI generates a lot of code. Focus on the 20% that handles sensitive operations.

Phase 3: Pattern Matching

Look for these specific AI code patterns:

Hardcoded credentials:

1
2
3

// AI loves doing this during development
const STRIPE_KEY = 'sk_live_...'
const DATABASE_URL = 'postgres://admin:password@...'

Missing server-side validation:

1
2
3
4
5

// Client validates, server trusts
const updateUser = async (userId, data) => {
  // No check that requesting user can modify this userId
  await db.users.update(userId, data);
};

JWT without expiration:

1
2
3

// AI often forgets expiration
const token = jwt.sign({ userId: user.id }, SECRET);
// Should be: jwt.sign({ userId: user.id }, SECRET, { expiresIn: '1h' });

SQL injection via string concatenation:

1
2

// Parameterized queries? Never heard of them
const query = `SELECT * FROM users WHERE id = ${userId}`;

The Audit Checklist

1
2
3
4
5

# Using gitleaks
gitleaks detect --source . --verbose

# Using trufflehog
trufflehog filesystem --directory .

1
2
3

npm audit
# or
snyk test

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

// Bad: AI does this
catch (error) {
  res.status(500).json({ error: error.message, stack: error.stack });
}

// Good
catch (error) {
  logger.error(error);
  res.status(500).json({ error: 'Internal server error' });
}

What I Find in 90% of Audits

After auditing hundreds of AI-generated codebases, these issues appear constantly:

1. IDOR vulnerabilities — Accessing resources by ID without ownership check
2. Missing CSRF protection — Forms submit without tokens
3. Insecure direct object references — API returns data based on user-provided IDs
4. Hardcoded development secrets — Test keys in production
5. Missing rate limiting — No protection against brute force

The fix for most of these is straightforward. The hard part is finding them before an attacker does.

Documentation and Reporting

Write findings as you go. For each issue:

• Location: File and line number
• Severity: Critical/High/Medium/Low
• Impact: What could an attacker do?
• Remediation: How to fix it
• Verification: How to confirm the fix

Prioritize by actual exploitability, not theoretical risk. A hardcoded API key with production access is more critical than a missing security header.

FAQ

Conclusion