On this page
How to Review AI-Generated Code Like a Senior Engineer
A practical checklist for reviewing AI-generated code: correctness, security, edge cases, and intent. Review what the assistant skips, not just what it wrote.
Quick answer
- Review AI code on four axes: does it do what you asked, does it do it correctly at the edges, is it secure, and will it be maintainable.
- Pay most attention to what the assistant didn’t write — error handling, authorization, tests.
- You don’t have to read every line, but you must read every line that touches data, money, or security.
The mindset
AI-generated code passes the “does it compile?” and “does the happy path work?” tests easily. A senior review spends its effort on the parts the assistant skips: edge cases, error paths, authorization, and intent. Treat the output as a capable junior’s first draft — usually right on the surface, unverified underneath.
Step 1 — Verify intent
Before reading code, confirm it does what you asked and nothing more. Check the diff for scope creep: did it change files, schema, or dependencies you didn’t request? How to verify it worked: you can list exactly what changed and why, and nothing is a surprise.
Step 2 — Check the edges
Look for the missing half of the logic: what happens on empty input, on failure, on a timeout, on a duplicate? Generated code handles the happy path and often nothing else. Ask “what if this fails?” for each external call.
Step 3 — Check the security surface
This is the highest-value step. Walk the OWASP Top 10 against the diff: any string-built SQL? Any object lookup without an ownership check (IDOR)? Any hardcoded secret? Any input trusted without validation? These are the failures generated code ships most often.
Step 4 — Check for tests and maintainability
Did it add tests, or only code? Does it duplicate logic that already exists? Is the naming clear enough that you could debug it in three months? If you can’t reason about the code now, you won’t be able to later.
Step 5 — Run it and verify the failure modes
Run the tests, then manually trigger a failure — a bad input, a downed dependency — and confirm the app degrades gracefully. How to verify it worked: the failure paths behave as intended, not with a crash or a silent data loss.
Where this bites vibecoders
The review is the moment vibe coding becomes engineering. You don’t need to read every line of a generated utility, but the line that fetches a record by ID without checking ownership will eventually be the breach, and it’s exactly one line to catch. Divide the diff: skim the boring parts, read the dangerous parts line by line.
Where AI coding assistants get this wrong
- Shipping happy-path code with no error handling.
- Omitting authorization checks on data access.
- Changing unrelated files or adding dependencies without being asked.
- Writing code that works but duplicates existing logic and diverges over time.
Checklist
- Confirm the diff does what was asked and nothing more.
- Trace error paths and edge cases, not just the happy path.
- Check the security surface: injection, access control, secrets, validation.
- Confirm tests exist and pass; add them where missing.
- Read every line that touches data, money, or security.
FAQ
Do I have to read every line?
No. Skim routine code and read the risky parts carefully: anything touching data, authentication, authorization, secrets, or external calls. That triage is what “reviewing like a senior” means in practice.
Should I let the AI review its own code?
AI can be a useful second pass for consistency and style, but it shares the blind spots that created the code. The security and intent review still needs your judgment — the assistant won’t reliably flag its own missing authorization checks.
How is this different from a normal code review?
The failure profile differs: human code has typos and logic bugs; generated code is more likely to be superficially correct but missing edge cases, authorization, and tests. The review targets the gaps the generator is prone to. See What Should You Actually Look For in a Code Review?.