AI-Generated Code Audit

The problem

Teams now merge code that a model drafted. The PR can look tidy and still be wrong: off-by-one in a pricing path, a missing authz check, tests that assert the mock, a dependency the author cannot explain. Reviewers skim because the style is consistent.

An AI-generated code audit is a structured review of that change set. It is not AI testing services (runtime behavior of an AI feature) and not AI-powered test automation (using AI to write tests).

What’s at risk

• Shipping logic the human never fully read
• Tests generated to match the code, including the bug
• Secrets, debug endpoints, or overly broad permissions the model “helpfully” added
• Licensing or copy-paste from training-data-shaped snippets — we can flag obvious copies; we are not a law firm

What we review

• The diff and the claimed intent
• Auth, data handling, and money paths if they are in the change
• Tests: do they fail when the code is broken?
• Error handling and defaults
• What is not in the PR that the story required

We do not run a secret “AI detector” to guess who typed. If you say the change was model-assisted, we review it as such.

How it runs

1. You point at the PR or branch and the ticket
2. We review like a hostile senior engineer, with extra suspicion for generated tests
3. We list must-fix vs nice-to-have
4. Optional: add a small manual or automation pass on the riskiest flow

Deliverables

• Written findings on the change
• Specific missing tests or unsafe defaults
• A clear “do not merge yet” or “merge with these follow-ups”

Suitable for

Teams using Copilot, Cursor, or in-house codegen on paths they cannot afford to get wrong.

FAQs

Is this a security audit?

It is a code review with security-minded checks on the diff. It is not a full application pentest.

Can you audit a whole repo of generated code?

We scope to a change or a module. “Audit everything” without a boundary is how reviews become theatre.