The AI Code Review Security Checklist
Before you ship AI-generated code from tools like Lovable, Bolt, v0, or Cursor, run through this security checklist. It catches the top vulnerability classes that large language models consistently miss when generating application code.
1. Authentication and Authorization
AI tools often scaffold routes without proper auth guards. Check every endpoint:
- Are protected routes behind authentication middleware?
- Does each API endpoint verify the caller has permission for the requested resource?
- Are admin-only operations protected by role checks, not just login checks?
- Can a user access another user's data by changing an ID in the URL?
2. SQL Injection and Query Safety
LLMs frequently generate raw string concatenation for database queries. Always verify:
- Are all database queries parameterized or using an ORM's safe query builder?
- Is user input never directly interpolated into SQL strings?
- Are search and filter inputs sanitized before hitting the database?
3. Hardcoded Secrets
A common LLM pattern is to include example API keys or credentials inline. Search your codebase for:
- API keys, database passwords, or JWT secrets in source code
- Credentials committed to version control
- Environment variables that should be in .env but are hardcoded
4. Input Validation
AI-generated endpoints often accept user input without validation. Check that:
- All user-supplied data is validated against an expected schema
- File uploads check MIME type and file size limits
- Email and URL fields are validated before use
5. Rate Limiting and Brute Force Protection
Authentication endpoints without rate limiting are vulnerable to credential stuffing and brute force attacks. Verify that your login, signup, and password reset endpoints have rate limiting applied.
Use Hammering.ai to run an automated scan that checks all of these patterns in your AI-generated codebase. Our scanner identifies the exact lines where vulnerabilities exist so you can fix them before shipping.