A practical security review for AI-generated code

AI coding tools can produce a useful first draft quickly. They can also repeat insecure patterns, invent APIs or make a risky change look plausible. A team gets the benefit when generated code enters an engineering process that makes its assumptions visible. Treat the output as a proposal from a fast contributor whose work still needs verification. Keep context and secrets controlled Before using a tool, decide what source code, customer information and credentials may leave the development environment. Review the provider and workspace settings, retention terms and access rules. Never paste production secrets into prompts. Keep generated files inside the same repository controls, branch protection and code review as other changes. Ask for a reviewable change Give the assistant one bounded task and request tests or a short explanation of the changed behaviour. Smaller diffs make it easier to check data validation, authorization, error handling and edge cases. A confident explanation is not evidence that a function is safe. Read the implementation and compare it with the actual framework and dependency documentation. Run layered checks Use formatting, static analysis, dependency scanning and automated tests where they fit the project. Add focused tests for access boundaries, malformed input and failure paths. For high-impact changes, ask a second engineer to inspect trust boundaries and data handling. Generated code must not bypass review because it was machine-produced. Learn from incidents and near misses Record recurring issues, such as permissive access, weak input handling or unmaintained packages, and improve prompts, templates and review checklists. Track time saved alongside defects caught and rework required. The right question is not whether an assistant wrote the code. It is whether the team can explain, verify and safely operate the code that ships.