Security Review for AI-Generated Code: What We Check

Code from a coding agent or an AI app builder usually does what you asked. It often does not do what you forgot to ask: restrict who can read a record, avoid logging a token, validate a file upload. A security review looks for those omissions. Below is the structure of a practical review for AI-generated web and mobile apps.

The review checklist, area by area

1. Secrets and configuration

• API keys, service credentials and tokens committed to the repository or history.
• Secret values embedded in a client bundle, which any user can extract.
• Separate configuration for development and production.
• Keys with more permissions than the app needs.

2. Authentication and authorization

Authentication answers who you are; authorization answers what you may do. Generated apps frequently get the first right and the second wrong. The review checks that every endpoint verifies ownership, not just login status. A typical flaw is an endpoint that returns any record when given an ID. If the app uses a backend-as-a-service with row-level rules, the rules are read line by line, because a permissive default can expose a whole table.

3. Input and output handling

• Server-side validation of all inputs, since client checks are easy to bypass.
• Protection against injection in queries and shell commands.
• Safe rendering of user content to avoid cross-site scripting.
• Limits and checks on file uploads.

4. Dependencies and supply chain

Agents sometimes add libraries casually, including unmaintained ones, or reference packages that do not exist. The review lists direct dependencies, checks that each is needed and maintained, scans for known vulnerabilities with standard tooling and pins versions so builds are reproducible.

5. Mobile-specific checks

1. Where tokens and personal data are stored on the device, and whether secure storage is used.
2. Whether traffic uses encrypted connections only.
3. Which permissions the app requests and whether each is justified, which also matters for store review.
4. Whether debug features or test endpoints remain in release builds.
5. What the app logs and whether logs contain personal data.

6. Data protection

Security and privacy overlap. The review compares what the app collects with what the privacy policy and store privacy disclosures say, and checks where data is hosted. For apps serving EU users, GDPR obligations and hosting options are part of the discussion. Building a GDPR-compliant mobile app covers this in more depth.

How findings are handled

A review is only useful if findings lead to fixes. Each finding is rated by impact, explained in plain language, fixed or consciously accepted, and retested. Agents can help with the fixes, but an engineer verifies them. This is also where an independent code audit adds value, since a fresh pair of eyes catches what the original author, human or agent, repeats.

Backend-as-a-service and database rules

Many AI-built apps rely on a hosted backend with database rules configured through a dashboard. These rules are code in disguise, and they deserve the same scrutiny. Reviewers check whether anonymous users can read or write, whether rules distinguish between owners and others, whether administrative functions are reachable from the client, and whether storage buckets for uploaded files are public by accident. A useful habit is to test the rules by trying to access another user's data with a normal test account. If that works, the rules are wrong, regardless of how the app looks in the interface.

Finally, confirm that logging and error messages do not expose internals. Detailed stack traces are helpful in development and a gift to attackers in production.

How apprat.io approaches it

At apprat.io, security review is part of the normal engineering flow, not a one-off at the end. Senior AI Code Engineers review every agent-generated change with these questions in mind, and jocapps GmbH operates ISO 27001 certified information security processes. The result is a documented set of checks you can ask about, rather than a general promise that the code is safe. No review can guarantee the absence of all vulnerabilities, but a repeatable one removes the common and expensive ones.

If you have an existing AI-built app and want a second opinion, book a call for free and describe what you have.