AI wrote your code. Here are 8 security checks it will not do for you

AI coding assistants can produce a working app in an afternoon. They can also produce an insecure one just as quickly, and the result looks identical until someone attacks it. Review these eight things before anything goes live.

• 1. Secrets stay out of the code. Passwords, API keys and payment keys belong in environment settings, never in files you upload to GitHub or paste into a chat.
• 2. Database queries are parameterised. Never build queries by gluing user input into text. That is how SQL injection happens.
• 3. Passwords are hashed. Use bcrypt or Argon2 through your framework. If you can read a user's password in the database, the design is wrong.
• 4. The server checks permissions. Hiding a button is not security. Every request must confirm that this user may see this record.
• 5. All input is validated and output is escaped. That stops script injection into your pages.
• 6. HTTPS and secure cookies everywhere. No exceptions, including on small internal tools.
• 7. Login attempts are limited. Rate limits and lockouts blunt password-guessing attacks.
• 8. Backups and updates are scheduled. Test restoring a backup, and keep libraries and the server patched.

A useful habit: after AI generates a feature, ask it to review its own code against this list, then verify the answers yourself. AI is a fast builder, and you are the inspector.