How to Review AI-Generated Code Before It Reaches Your SaaS Production

AI coding tools (Cursor, Claude, Windsurf) write code 10x faster than hand-coding. But speed is a double-edged sword: the same speed that lets you ship features quickly also lets you ship bugs, security holes, and broken patterns quickly. If you deploy AI-generated code without reviewing it, you are trusting a machine with your production, your customers, and your revenue. This article is the code review checklist for AI-generated code — the specific things to check before letting AI's output reach your SaaS production.

The direct answer is that reviewing AI-generated code has seven checks: compilation (does it build?), security (are there vulnerabilities?), dependencies (are new packages necessary and safe?), database changes (are migrations safe?), patterns (does it follow existing conventions?), tests (are there tests, and do they pass?), and secrets (are any secrets hardcoded?). Each check takes 2-5 minutes, and together they take 15-30 minutes — a small price for preventing a production incident. For more on AI deployment safety, see our article on the safe AI deployment workflow for SaaS founders.

Check 1: Compilation (Does It Build?)

The first check is the simplest: does the code compile? Run npm run build (or equivalent) and verify there are no errors. AI can hallucinate imports (e.g., importing a package that does not exist), use incorrect syntax, or reference variables that do not exist. The build will catch these issues.

If the build fails, do not fix the errors yourself — ask the AI to fix them. The AI can read the build errors and propose fixes, which is faster than manual debugging. For more on build failures, see our article on why AI-generated Next.js apps fail to build.

Check 2: Security (Are There Vulnerabilities?)

AI-generated code can introduce security vulnerabilities. Check for:

Hardcoded secrets. Search for sk_live_, ghp_, AKIA, and other secret-like patterns. If found, move them to environment variables. For more, see our article on the secrets management gap.

SQL injection. Check for string concatenation in SQL queries (e.g., SELECT * FROM users WHERE id = + req.params.id). Use parameterized queries instead.

XSS. Check for dangerouslySetInnerHTML (React) or v-html (Vue) with user input. Sanitize user input before rendering.

Authentication bypass. Check if the AI added any endpoints that are not protected by authentication. For more on auth security, see our article on the JWT authentication trap.

Missing input validation. Check if the AI validates user input (e.g., required fields, field types, field lengths). For more on validation, see our article on the file upload trap.

Check 3: Dependencies (Are New Packages Necessary and Safe?)

AI often adds new dependencies (e.g., clsx, date-fns, zod). Check each new dependency:

Is it necessary? Can the same functionality be achieved with existing dependencies or native JavaScript?
Is it safe? Check the package on npm for vulnerabilities (npm audit).
Is it maintained? Check the last publish date and the number of downloads.
Does it conflict with existing dependencies? Check for peer dependency conflicts.

For more on dependency management, see our article on the dependency hell trap.

Check 4: Database Changes (Are Migrations Safe?)

If the AI modified the database schema, review the migration carefully:

Does it drop columns or tables? Dropping columns causes data loss. Use a multi-step migration (add new column, backfill, switch, drop old) instead.
Does it add NOT NULL constraints? Adding a NOT NULL constraint to an existing column can fail if there are NULL values. Backfill the values first.
Does it create indexes? Creating indexes on large tables can lock the table. Use CREATE INDEX CONCURRENTLY (Postgres).
Does it change column types? Changing a column type can cause data loss. Use a multi-step migration instead.

For more on database migrations, see our article on the database migration trap.

Check 5: Patterns (Does It Follow Existing Conventions?)

AI does not always follow your project's conventions. Check:

Naming. Does the AI use the same naming convention (e.g., camelCase vs. snake_case) as the rest of the codebase?
File structure. Does the AI put files in the right directories (e.g., src/components/ for React components)?
Error handling. Does the AI use the same error handling pattern (e.g., try-catch with structured logging) as the rest of the codebase?
API patterns. Does the AI follow the existing API pattern (e.g., RESTful routes, consistent response format)?

If the AI's code does not follow conventions, ask it to refactor. For more on code patterns, see our article on the state management mess.

Check 6: Tests (Are There Tests, and Do They Pass?)

AI-generated code should include tests. Check:

Did the AI write tests? If not, ask it to write tests for the new feature.
Do the tests pass? Run npm test (or equivalent) and verify all tests pass.
Do the tests cover edge cases? Check for tests that cover empty input, invalid input, and boundary conditions.
Do existing tests still pass? The AI's code should not break existing tests.

For more on testing, see our article on the testing void.

Check 7: Secrets (Are Any Secrets Hardcoded?)

This check is critical and deserves its own section (even though it was mentioned in Check 2):

Search for hardcoded secrets. Use grep -r "sk_live_\|ghp_\|AKIA\|password.*=.*['\"]" src/ to find potential secrets.
Check `.env` files. Ensure .env is in .gitignore and is not committed.
Check for `NEXT_PUBLIC_` secrets. Variables prefixed with NEXT_PUBLIC_ are inlined into client-side JavaScript. Never use NEXT_PUBLIC_ for secrets.

For more on secrets management, see our article on a founder's guide to environment variables, secrets, and least privilege.

The 30-Minute Review Process

Here is the 30-minute review process:

Build (5 minutes). Run npm run build. Fix any errors (ask the AI).
Security scan (5 minutes). Search for hardcoded secrets, SQL injection, XSS, and missing auth.
Dependency review (5 minutes). Check new dependencies for necessity and safety.
Database review (5 minutes). Review migrations for data loss risk.
Pattern review (5 minutes). Check naming, structure, and error handling.
Test review (5 minutes). Run tests, verify they pass, check edge cases.

Common Pitfalls and Troubleshooting

The first pitfall is skipping the review. If you trust AI-generated code without reviewing it, you are asking for trouble. The fix is to always review before deploying. The second pitfall is reviewing too quickly. A 5-minute review is not enough to catch all issues. The fix is to spend at least 30 minutes on the review. The third pitfall is not asking the AI to fix issues. If you find an issue, do not fix it yourself — ask the AI to fix it. The AI can read the issue and propose a fix, which is faster. The fourth pitfall is not checking for hardcoded secrets. This is the most dangerous pitfall, because hardcoded secrets can lead to a security breach. The fix is to always search for secrets in the review. The fifth pitfall is not testing. Even if the code compiles and follows patterns, it might not work correctly. The fix is to always run tests and to test manually.

Conclusion: Review Is Not Optional

AI-generated code can be fast, correct, and secure — but only if you review it. By spending 30 minutes on the seven checks (compilation, security, dependencies, database, patterns, tests, secrets), you catch the issues that AI misses and prevent production incidents. Review is not optional — it is the difference between shipping fast and shipping fast safely.

Ready to review your next AI-generated feature? Use the 30-minute review process above. For more, see the safe AI deployment workflow for SaaS founders and the five common AI coding mistakes. Explore our free developer tools to speed up your workflow.