Specific risks.
WHY SECURITY CODE IS DIFFERENT
Security failures are silent. Code that works and is insecure passes every functional test.
COMMON GENERATED VULNERABILITIES
Input not validated Injection vulnerabilities in database queries Authentication and session handling done poorly Secrets in code Outdated cryptographic approaches Permissive defaults
WHY THIS HAPPENS
Models learned from public code, much of which is insecure.
They reproduce common patterns, including common mistakes.
WHAT TO ALWAYS REVIEW
Anything handling user input Anything handling authentication Anything handling payment or personal data Anything touching the file system Database queries
WHAT TO USE ALONGSIDE
Static analysis tools Dependency scanning Actual security review for anything consequential
FOR NON-DEVELOPERS
If you do not understand what generated code does, do not run it on anything that matters.
Back up first, always.
THE PRINCIPLE
AI accelerates writing code. It does not make you a security reviewer.
