Is AI-written code secure? How we review it

Code written with AI is secure when a senior developer reviews it before deployment, it passes automated tests and it follows the same security rules as hand-written code. The raw output of an AI assistant without review is not secure, because AI writes confidently even when it is wrong.

At SaveIT we write code with AI assistants every day. The speed is real, but it did not come for free: we paid for it with discipline in review. Here is how we do it and what to watch for if you use AI-written code too.

Why AI code is not automatically secure

An AI assistant has no bad intentions, but it has no context either. It does not know who can access what in your application, which data is sensitive or what happens when someone sends unexpected input. It fills in what looks likely. That is why similar mistakes keep showing up in its output:

• Missing authorisation checks. The feature works, but a user who should not be able to call it can, for example a customer opens someone else's invoice by changing a number in the URL.
• Unsanitised input. A hastily assembled database query or HTML output without escaping opens the door to SQL injection and XSS.
• Secrets in code. An API key or password pasted straight into a file that ends up in the repository.
• Invented or outdated libraries. AI sometimes suggests a package that does not exist, or a version with a known vulnerability.
• Overly permissive settings. CORS open to everyone, certificate checks disabled "to make it work", debug mode in production.
• Bugs that do not show up straight away. The code passes on test data and fails under concurrent requests or higher volume.

None of this is new. People make the same mistakes. The difference is that AI produces them faster and with confidence, so without review they reach production sooner.

How we review code we write with AI

Our principle is simple: AI writes, a senior decides and takes responsibility. Nothing goes to production that a human has not seen. Every change goes through the same steps, whether it is a 15-minute tweak or a new module.

Step	What happens	Who
Brief	The senior understands what should change and what the change will affect.	senior
Code proposal	The AI assistant proposes the change, tests and documentation updates.	AI supervised by a senior
Review	The senior reads every line of the diff, not just the result on screen.	senior
Tests and CI	Automated tests and checks run on every change.	CI
Deployment	The change goes to production and we verify that it really works.	senior

What the senior looks for in review

Review is not a quick glance. With AI code we focus mainly on where AI tends to go wrong: who is allowed to perform the action, where the data comes from and whether it is sanitised, what happens on an error or when the other side is down, and whether the change does more than was asked. The last point matters more than it seems. AI likes to "help" and, while fixing one thing, rewrites the neighbouring one that nobody needed changed.

Tests and CI as a safety net

AI is very good at writing tests, and that is its best use for security. We have it prepare the awkward cases too: empty input, another user, invalid data. The senior checks that each test really verifies what it should, not just what the code happens to do. CI then runs the tests on every change, so old bugs do not come back.

Access and secrets

Passwords and keys belong in the environment configuration, not in code. The AI assistant works with code, not with your customers' production data. If a task needs data, we work with the minimum it requires.

Where AI actually improves security

It would be unfair to talk only about risks. Directed well, an AI assistant helps security too. It does not have bad days and does not get tired on the twentieth form, so it consistently adds validation where a tired person would skip it. It can quickly go through a large chunk of unfamiliar code and flag suspicious spots we would otherwise hunt for for hours. And because writing tests with AI is cheap, there are more tests, not fewer.

In practice, a project where a senior works with AI tends to have better test coverage and fewer forgotten edge cases than similar projects written by hand under deadline pressure. The condition stays the same: someone has to read the result and understand it.

Vibe-coded projects: the biggest risk

We see the most security problems not in code written by an experienced developer with AI, but in applications someone assembled with an AI tool without a programming background. They work, they look good, and yet they have an open admin panel, keys in the browser or a database without access control. That is not the author's fault; the AI tool simply does not know what it does not know. If you have such an application and want to put it in front of customers, have a look at our AI code to production service, where a senior goes through it, fixes it and gets it ready for production.

How to vet a supplier who codes with AI

Almost everyone writes code with AI today. So do not ask whether a supplier uses it, ask how they check the result:

• Who reads every change before deployment and takes responsibility for it?
• Does the project have automated tests, and do they run on every change?
• Where are passwords and keys stored, and who has access to them?
• Will you get access to the repository and the change history?
• What happens when a bug appears after deployment?

A vague answer to these questions is a warning sign, whether the code is written by AI or by a person. If you are not sure about the state of an existing system, a code audit helps.

Security is not just code

Even a perfectly written application is vulnerable if it runs on an unpatched server without backups. Operations are part of security: updates, separate environments, encrypted backups and tested restores. More in the article Backups and security of company data and in our hosting and DevOps service.

Summary

AI does not make code more or less secure on its own. It makes it faster, and with speed comes a greater need for review. When review is in place, you get quality code sooner and cheaper. With us you pay €38 / hour excl. VAT for a senior who works with AI and stands behind the result. More on how we work in our AI-powered software development service.

Have AI-written code and not sure it is secure? Write to us and a senior will take a look.