What to Check Before You Ship AI-Generated Code

Before you ship anything built mostly with AI, verify five things: no secrets are exposed, access control actually works, all input is validated, personal data is handled and stored properly, and the app fails safely instead of leaking or crashing. If you cannot confidently tick all five, it is not ready for real users, no matter how good the demo looks.

AI tools make it dangerously easy to reach "it works" without reaching "it is safe." This checklist closes that gap. It pairs with why AI-built apps are often a security risk.

1. Secrets and credentials

• No API keys, passwords, or tokens hard-coded or exposed in the client or the repository.
• Secrets loaded from environment configuration, never committed.
• Payment and third-party credentials treated like cash.

If AI put a key in the front-end code, an attacker can read it. This is the most common and most damaging AI-build mistake.

2. Access control and authentication

• Every protected route and record actually checks who is asking.
• Users cannot reach data or actions that are not theirs by changing an ID in the URL.
• Admin functions are genuinely separated from public ones.

AI often builds the feature and forgets the authorisation. Test it deliberately.

3. Input validation

• Every field and endpoint validates and sanitises what it receives.
• The system is tested with bad, empty, and malicious input, not just the happy path.
• Uploads and forms are constrained and checked.

This is the door to most attacks, and the prompt almost never mentioned it.

4. Data handling

• Personal data is stored and transmitted securely, with sensible retention.
• You can honour access and deletion requests, a real obligation under the Kenya Data Protection Act.
• You collect only what you need.

5. Reliability and the bad day

• Errors are handled and logged safely, not surfaced to users or leaked.
• There is a tested backup and a restore you have actually tried, as in the cybersecurity checklist for SMEs.
• Payment flows handle failure, delay, and duplicates, especially for M-PESA.

How to use this

Run it as a hard gate before launch. If you do not have an engineer who can confidently sign off each section, get a focused review first. It is far cheaper than the incident it prevents. The deeper reason someone must be accountable, not just the tool, is covered in AI can write code but cannot own the outcome.

Frequently asked questions

Can I ship an AI-built app without a technical review?

For a throwaway prototype, sometimes. For anything handling real users, money, or personal data, no. AI reliably produces code that looks finished but is not safe. A short review before launch prevents the expensive mistakes.

What is the single most important thing to check?

Exposed secrets and broken access control. A leaked API key or an endpoint that returns anyone's data is a serious incident, and both are extremely common in AI-generated code. Check these first.

How long does a pre-launch review take?

For a typical small app, a focused review is fast and inexpensive relative to the risk. It tells you where the real exposure is and what to fix before you go live, rather than after an incident.

Does this mean AI tools are bad?

No. They are powerful accelerators. The point is that speed to "it works" is not the same as "it is safe," and someone accountable has to close that gap before real users arrive.

Built something with AI and want a clear go or no-go before launch? Send it to us for a review. We will tell you exactly what to fix first.