Production rescue
AI-Generated Code Audit
Short answer
An AI-generated code audit is a structured review of auth, authorization, secrets, data access, payments, and deploy — not a vibe check of whether the UI “looks done.”
What is an AI-generated code audit?
A time-boxed review of a repo produced mostly by an AI builder or IDE agent, scored against a production checklist. Output: a punch list, not a marketing PDF.
Audit areas
| Area | Fail example | Pass example |
|---|---|---|
| Secrets | OpenAI key in the client | Server-only, rotated |
| Authz | IDOR on /api/orders/[id] | User can only read own rows |
| Data | No backups, no RLS | Daily backup + policies |
| Payments | Success URL = entitlement | Webhook + idempotency |
How to run a cheap audit yourself
Clone the repo. Search for API keys, supabase.from without filters, and fetch calls to your own API that do not send a session. Click every write path as a second user. If you can edit someone else’s row, you failed.
What a reviewer should deliver
A severity-ranked list (P0 ship-blockers vs later), a recommended path (harden vs rebuild), and an estimate. If the deliverable is “you need us, trust us,” that is a sales call, not an audit.
FAQ
How long does an AI code audit take?
A small Next.js app: 1–3 days. A multi-tenant SaaS with payments and file uploads: a week.
Is this the same as a pentest?
No. This is a production-readiness review. A pentest is a later, scoped security engagement.
Related
Want a punch list, not a pitch?
Send the repo. You’ll get harden vs rebuild and the P0s — including ones you can fix without us.