Security Review of Generated Code
Find the injection flaws, broken access checks and leaked secrets that AI generated code commonly introduces
A taste of a lesson
The assistant wrote GET /invoices/{id} and it checks the user is logged in. Anything else I should check?
Yes, the key question: does it check that this invoice belongs to the logged in user, or their organisation? If it fetches by ID alone, any user can change the number in the URL and read other customers' invoices. Look for the query: it should filter by both the invoice ID and the user's account, or check ownership after loading. Also make sure a missing or foreign invoice returns the same response, so IDs cannot be probed. Is there a test where one user requests another user's invoice?
Written by the teacher as an example. In your lesson the tutor answers your own questions, and like any AI it can be wrong.
What you will be able to do
- Recognise the insecure patterns AI generated code commonly repeats
- Trace untrusted input from entry points to where it is used
- Review authorisation logic for every data access on the server
- Combine scanners for patterns with human review for logic flaws
- Instruct assistants and project files to produce safer code by default
Lesson plan
- 1 Why generated code needs security review Understand how assistants reproduce insecure patterns and why speed raises risk. Start
- 2 Injection and output encoding Find places where untrusted input reaches queries, commands or pages unsafely. Start
- 3 Authentication and access control Check that every action verifies who the user is and what they may access. Start
- 4 Secrets, files and outbound requests Catch leaked secrets, unsafe file handling and risky URL fetching. Start
- 5 Dependencies and configuration Review the libraries and settings generated code brings in. Start
- 6 Tools, prompts and process Build security into the workflow around AI assisted coding. Start
Try asking
About this tutor
For developers, reviewers and security minded engineers who need to review code produced with AI help. Generated code tends to repeat insecure patterns found in public examples: string built queries, missing authorisation checks, unsafe deserialisation, weak cryptography, verbose error messages and secrets in code. You will learn a security focused review checklist organised by risk, how to trace untrusted input from entry to use, how to check authentication and authorisation logic, how to use automated scanners alongside manual review, and how to instruct assistants to produce safer code from the start.
Reviews
4.7
3 ratingsSample
- Priscilla A.Sample
We added security requirements to our instruction file and a secret scanner in CI after this. Practical and not alarmist.
- Daniel F.Sample
Strong data flow tracing method. I already knew the common vulnerability lists, but the review process was new and useful.
- Oksana T.Sample
The 'logged in is not the same as owning it' lesson found a real access control gap in our API. Calm, precise teaching.
About the teacher
I teach how to review, test, refactor and secure code written with AI help
9 tutors 320 lessons taught Sample
I care about what happens after the code is generated. My background is in code review, testing and application security, and I teach developers to treat AI output as a draft from a fast, confident colleague who has never seen production. We practise reading diffs carefully, writing tests before asking for code, refactoring old systems in safe steps and spotting...
See Ilse's profile and tutorsMore like this
Other tutors on the same or nearby topics.