AI-generated code can contain the same security flaws as human code, and it often looks confident and correct while hiding them. The usual risks are weak authentication and permissions, injection, leaked secrets, unsafe dependencies and poor error handling. Treat AI code as untrusted until it has been reviewed and tested.
Why the risk is real
AI writes code that resembles code it has seen, including insecure patterns. It does not know your threat model, your data sensitivity or your compliance duties unless you say so, and even then it can miss things. Because the output looks tidy, people review it less carefully than they should.
Common problems
| Risk | What it looks like |
|---|---|
| Weak authentication | Missing login checks, passwords handled poorly, tokens that never expire |
| Broken authorisation | Any logged-in user can read or change another user's data |
| Injection | User input put straight into database queries, shell commands or pages |
| Leaked secrets | API keys hard-coded in code or committed to the repository |
| Unsafe dependencies | Outdated or non-existent packages, or ones with known issues |
| Sensitive data exposure | Logging personal data, returning too much in API responses |
| Missing rate limits | Login and form endpoints that can be hammered |
| Poor error handling | Stack traces and internal details shown to users |
How to reduce the risk
- Specify security requirements in the prompt, and still verify.
- Review authentication, authorisation, payments and data storage by hand. These deserve the most careful reading.
- Use proven libraries for login, sessions and encryption instead of custom code.
- Scan dependencies for known vulnerabilities and confirm each one is real and maintained.
- Scan for secrets before every commit.
- Validate and sanitise input, and use parameterised queries.
- Apply least privilege. Give each part only the access it needs.
- Add rate limits and monitoring.
- Test security with checks specific to your risks.
Multi-tenant and sensitive systems
If your software serves many customers, such as a SaaS platform, data isolation between customers must be enforced on the server, not only in the interface. Role-based access, token rotation, rate limiting and deny-by-default rules are standard practice, and they need review whoever wrote the code. See our SaaS product development service.
Process beats hope
Keep a short security checklist in your review process. See reviewing AI-written code and AI coding do's and don'ts.