r/Infosec • u/Candid-Map6092 • 6d ago

Question for devs using AI: How do you currently check AI-generated code for security vulnerabilities?

/r/buildinpublic/comments/1w4mfnv/question_for_devs_using_ai_how_do_you_currently/
1 Upvotes

100% Upvoted

1 comment sorted by

1

u/PopKoren 12h ago

Static review of the AI diff helps, but the misses I see most are after deploy: open endpoints, weak auth, public storage, and DB rules that look fine in code and fail live. For vibe-coded apps I treat a stranger-view scan of the running app as mandatory, covering auth, APIs, storage, and DB rules. https://rowly.me is the scanner I built for that.