A checklist for reviewing AI-generated code before you ship

Generated code usually compiles and looks idiomatic, so problems hide in what's missing rather than what's wrong: absent authorization checks, unhandled errors, invented APIs, and configuration copied from examples.

• Every server endpoint checks who the user is and whether they may access that specific record — not just that they're signed in.
• Database access rules (for example Postgres row-level security) exist for every table the browser can reach.
• No secrets in client code, repository history or example env files that were committed.
• User input is validated on the server, and output is escaped wherever HTML is rendered.

• Every library function the code calls actually exists in the version you installed.
• Error paths are handled: network failures, empty results, timeouts, duplicate submissions.
• Money, dates and time zones use the right types and rounding.
• Business rules (tax, discounts, permissions) were checked against the real requirement, not the AI's guess.

• Duplicated logic is consolidated so one fix doesn't need to be made in five places.
• Names describe what things are, and dead code from earlier attempts is removed.
• There are at least a few tests for the paths that matter most.

Post specific questions to the community, or request a validation to have a reviewer document findings with evidence and retest your fixes.