You've used Cursor, ChatGPT, or another AI tool to build your app. Now what? Even if you're not a developer, you can (and should) review what the AI generated before shipping it to users.
After performing 500+ code reviews on AI-generated apps, here's the exact process I use. Even a basic review catches the most dangerous issues.
Why You Need to Review AI Code
AI coding tools are incredibly good at making code that works. They're not good at making code that's secure, fast, and maintainable. Every AI-generated codebase I've reviewed has had at least a few issues that needed fixing before production.
A code review catches these problems before your users encounter them.
Step 1: Check for Exposed Secrets
This is the most critical check and anyone can do it. Search your entire codebase for:
- API keys (search for
sk_,pk_,api_key,apiKey) - Database connection strings (search for
postgres://,mongodb://,mysql://) - Passwords or tokens hardcoded in the source
- Any
.envfile committed to git (rungit log --all -- .env)
Quick check: Run grep -r "sk_" --include="*.js" --include="*.ts" . in your project directory to find potential Stripe secret keys.
If you find anything, move it to environment variables immediately and rotate the exposed key.
Step 2: Review Authentication and Access Control
For every API endpoint in your app, ask:
- Does this require a logged-in user? If so, is there an auth check?
- Can a user access another user's data by changing an ID in the URL?
- Are admin-only actions protected from regular users?
- Does logout actually clear the session?
AI tools are notorious for building features without protecting them. We find unprotected API routes in about 70% of AI-generated apps.
Step 3: Look at Error Handling
Open your browser's developer tools, go to the Console tab, and use your app. Try to break it:
- Submit forms with empty fields
- Enter extremely long text
- Turn off your internet and try to use the app
- Open the app in an incognito window (no login state)
If the app crashes, shows a blank screen, or displays a technical error message to users, the error handling needs work.
Step 4: Test with Real-World Data
AI-generated apps are usually tested with tiny amounts of data. Try:
- Creating 100+ items in a list (does pagination work?)
- Uploading large files
- Entering special characters (&, <, ', ") in text fields
- Using the app with a slow network (throttle in Chrome DevTools)
Performance issues and crashes that don't appear with 5 test items will surface quickly with real-world data volumes.
Step 5: Run Automated Security Scans
Even without security expertise, you can run free tools:
npm audit— checks for known vulnerabilities in your dependencies- Lighthouse (built into Chrome) — checks performance, accessibility, and best practices
- Snyk (free tier) — scans your code and dependencies for security issues
- OWASP ZAP (free) — tests your running app for common web vulnerabilities
Step 6: Check the Database
If your app uses a database, check:
- Are there indexes on columns used in search and filtering?
- Is sensitive data (passwords, tokens) hashed or encrypted?
- Are backups configured?
- Is the database accessible from the public internet? (It shouldn't be)
Step 7: Review the Deployment Configuration
Before going live, verify:
- Environment variables are set in your hosting platform
- HTTPS is enforced
- Error messages don't expose stack traces in production
- Debug mode / development mode is turned off
- There are no
console.logstatements leaking sensitive data
What a Professional Code Review Adds
The steps above catch the most obvious issues. A professional code review goes deeper:
- Architecture analysis — is the code structured in a way that can grow?
- Performance profiling — identifying N+1 queries, memory leaks, and bottlenecks
- Security testing — SQL injection, XSS, IDOR, and other OWASP vulnerabilities
- Code quality assessment — technical debt evaluation and refactoring priorities
- Actionable recommendations — not just "what's wrong" but "here's how to fix it"
Want a Professional Review?
Our code review service covers everything above and more. Get a comprehensive report with prioritized fixes from a senior engineer who specializes in AI-generated code.
Get a Code Review ($249)