AI-generated code security review
AI coding tools write code that compiles, reads well and looks finished, and it often contains vulnerabilities that look completely idiomatic. HYDN reviews AI-generated and 'vibe coded' applications and smart contracts for the flaws these tools tend to introduce: missing access checks, insecure defaults, exposed secrets, outdated or invented dependencies and logic that only works on the happy path.
What we look for
- Access control. Endpoints, database rules and contract functions with no authorisation check, because the prompt never asked for one.
- Insecure defaults. Permissive CORS, debug modes, open storage buckets and database rules left as generated.
- Secrets. API keys and credentials written into code or client bundles.
- Dependencies. Outdated packages, and package names that do not exist and could be registered by an attacker.
- Input handling. Injection and unsafe deserialisation in code that was only tested with expected input.
- Logic. Edge cases, error paths and race conditions the generated code never considered.
- Smart contracts. Rounding, access modifiers, reentrancy and upgrade patterns that look standard but are subtly wrong.
How we review
We combine a manual code review with testing of the running application, so findings are confirmed rather than theoretical. For smart contracts, the review follows the full HYDN audit process.
Frequently asked questions
Is AI-generated code less secure than human code?
It is not reviewed by the person who wrote it in the same way, and it tends to reproduce patterns from its training data, including insecure ones. The bigger risk is speed: code ships faster than anyone checks it.
Do you review AI-written smart contracts?
Yes. We are finding a rising number of vulnerabilities in generated Solidity that look idiomatic and are not, which is why every HYDN audit is led by a human.
Published Updated