Stop 41 of 42 · The New Hire · Trusting unreviewed AI code

Signing what you haven’t read

The bank’s builder hands the new hire a job: “build me an orders page.” Minutes later it is done, tidy, and it works. The builder clicks around, sees the right orders, and signs off without reading the plans. What the page never does is ask a visitor for a badge, check whose orders they are, or keep its keys out of sight. Nothing broke, so nothing warned anyone. Studies point the same way: Veracode’s 2025 report, testing over 100 AI models, found 45% of the code samples failed its security tests and introduced OWASP Top 10 vulnerabilities, and a 2022 Stanford study of 47 programmers found people using an AI assistant wrote significantly less secure code and were more likely to believe it was secure.

The New HireSources checked 25 Oct 2026

Watch it happen

Play it as

Alice ships an AI-built orders page after only clicking through it herself. Mallory asks for it with no badge, and the page hands over everything.

Arrival

Alice, the bank’s builder, asks her fast new assistant for a page where customers can see their orders. It is ready in minutes.

Alice says: Build an orders page. AI assistant says: Done! It works great.
1 / 5

In bank terms and app terms

In the bankIn your app
The new hire’s finished workCode an AI tool wrote for you
Signing without readingShipping code you did not review or test
Badge check at the windowLogin and ownership checks the AI left out
A second customer’s visitTesting as another user and as a logged-out visitor

Are you exposed?

You might be exposed if…
  • You accept AI changes because the app runs and looks right, without reading them.
  • You only test by logging in as yourself, never as another user or a logged-out visitor.
  • Nothing runs automatically on each change to catch leaked keys, risky queries, or known-bad libraries.
What to do about it
  1. Ask for the security rules in your request: who may see what, queries built with placeholders, and no secret keys in browser code.
  2. Read every change before it ships, and test as a second user and as a logged-out visitor.
  3. Run automatic checks on every change: secret scanning, a dependency audit such as npm audit, and a security scanner or linter.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt
Review the code in this project that you or another AI tool wrote. For every route and database table, check that it requires login, filters data to the current user (and, if we use Supabase, has row-level security enabled with policies), builds queries with placeholders instead of string joins, and keeps secret keys out of browser code. List what is missing and show me a plan before changing anything. Then fix it and write a test that calls each route as a logged-out visitor and as a different user.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.