Code Review Checklist for AI-Assisted Development

Code review is essential for any software project. But when AI writes a significant portion of your code, traditional review checklists miss critical issues.

AI-generated code has unique characteristics—it follows patterns from training data, not from your team's standards. It optimizes for readability over security. It copies examples that were never meant for production.

This checklist ensures you catch AI-specific issues before they reach your codebase.

Authentication and Authorization

AI models often generate authentication code that looks correct but has subtle flaws.

• [ ] Password storage uses current algorithms (bcrypt, argon2), not MD5 or SHA1
• [ ] Session tokens are cryptographically random, not predictable
• [ ] Authentication checks happen on every protected route, not just the login page
• [ ] Authorization verifies the user has access to the specific resource, not just that they're logged in
• [ ] Password reset tokens expire and are single-use
• [ ] MFA implementation follows current best practices
• [ ] OAuth flows validate state parameters to prevent CSRF

Red flag: AI often generates authentication code from outdated tutorials. Check the patterns against current OWASP guidelines.

Data Access and SQL Safety

SQL injection has been a top vulnerability for decades. AI still generates vulnerable code.

• [ ] All database queries use parameterized statements
• [ ] No string concatenation in SQL, even for "safe" values
• [ ] ORM queries don't bypass parameterization
• [ ] Row-level security is implemented where appropriate
• [ ] API endpoints return only authorized data (no IDOR vulnerabilities)
• [ ] Bulk operations have proper access controls

Red flag: Watch for AI-generated code that constructs queries dynamically based on user input.

Input Validation and Sanitization

AI trusts user input too much. It was trained on examples where input was controlled.

• [ ] All user input is validated on the server side
• [ ] Client-side validation is treated as UX, not security
• [ ] File uploads have type validation, size limits, and virus scanning
• [ ] JSON input is validated against a schema
• [ ] HTML output is properly escaped to prevent XSS
• [ ] URL parameters are sanitized before use
• [ ] File paths are validated to prevent directory traversal

Red flag: AI often skips validation for "internal" APIs, assuming they'll never be called maliciously.

Secrets and Credentials

AI doesn't understand that secrets shouldn't be in code. It saw secrets in training data and learned to include them.

• [ ] No hardcoded API keys, passwords, or tokens
• [ ] Secrets are loaded from environment variables or secret managers
• [ ] Example credentials are clearly marked and different from production
• [ ] Debug endpoints don't expose configuration
• [ ] Logs don't accidentally capture sensitive values
• [ ] Frontend code doesn't contain backend secrets

Red flag: Search for common secret patterns—API keys, connection strings, private keys. AI often generates them inline.

Error Handling and Logging

AI-generated error handling often exposes too much information.

• [ ] Error messages don't reveal internal implementation details
• [ ] Stack traces are hidden from end users
• [ ] Logging doesn't capture sensitive data (passwords, tokens, PII)
• [ ] Errors are properly categorized and monitored
• [ ] Rate limiting is in place to prevent log flooding
• [ ] Debug mode is disabled in production

Red flag: AI often generates verbose error handling helpful for development but dangerous in production.

Dependency Management

AI suggests packages based on training data, which may be outdated or vulnerable.

• [ ] All suggested packages are currently maintained
• [ ] Package versions are pinned, not floating
• [ ] No known vulnerabilities in dependencies
• [ ] License compatibility is verified
• [ ] Packages come from trusted registries
• [ ] Minimum necessary dependencies—no "kitchen sink" installs

Red flag: AI often suggests packages that were popular 2-3 years ago but are now unmaintained.

API Design

AI generates API patterns from public examples, which may not follow your standards.

• [ ] Endpoints have consistent naming conventions
• [ ] Response formats match your API standards
• [ ] Versioning is implemented correctly
• [ ] Rate limiting is in place
• [ ] CORS configuration is appropriate
• [ ] Input and output types are documented
• [ ] Error responses follow a consistent format

Red flag: AI often mixes REST conventions or generates inconsistent endpoint patterns.

Performance and Scalability

AI optimizes for clarity, not performance. It may generate code that works but won't scale.

• [ ] Database queries use indexes efficiently
• [ ] N+1 query problems are identified and fixed
• [ ] Large datasets use pagination
• [ ] Expensive operations are cached appropriately
• [ ] Memory usage is bounded
• [ ] Background jobs handle long-running operations

Red flag: AI often generates nested loops with database calls inside—check for performance anti-patterns.

Testing

AI can generate tests, but they may not cover edge cases or security scenarios.

• [ ] Tests cover the happy path and error cases
• [ ] Security-specific tests exist for authentication flows
• [ ] Edge cases are tested (empty inputs, boundary values)
• [ ] Integration tests verify component interactions
• [ ] Tests don't have hardcoded values that mask bugs

Red flag: AI-generated tests often pass even when the code has bugs—verify they actually test the right things.

Documentation and Maintainability

AI documentation can be inconsistent or outdated relative to the code.

• [ ] Comments match what the code actually does
• [ ] Function documentation is accurate
• [ ] Complex logic is explained
• [ ] Configuration options are documented
• [ ] Dependencies are documented with their purpose

Red flag: AI sometimes generates documentation that describes what the code "should" do, not what it actually does.

Automating the Checklist

Reviewing all of this manually for every AI contribution is impractical. That's where VCX comes in.

VCX automates detection of:

• Security vulnerabilities in AI-generated code
• Hardcoded secrets and credentials
• Outdated or vulnerable dependencies
• Authentication and authorization issues
• Input validation gaps

Run VCX on every pull request. Let automation catch what human review might miss.

Building Trust in AI-Assisted Code

AI-assisted development is here to stay. The question isn't whether to use it, but how to use it safely.

This checklist, combined with automated tools like VCX, ensures your vibe-coded projects maintain the same security and quality standards as human-written code. Review every AI contribution. Trust but verify.