Reviewing AI-Generated Code
AI output still needs a human pass. Spot the planted issues in a real snippet before they ship.
Intermediate12 min read
AI-generated code runs, and running is not the same as correct. This snippet has 3 planted issues. Click on anything that looks suspicious to find them.
average.js0 of 3 issues found
function calculateAverage(scores) {
const apiKey = ;
let total = 0;
for (let i = 0; i scores.length; i++) {
total += scores[i];
}
return total ;
}
Before you merge, check
- →Readability: could a teammate understand this without you explaining it?
- →Edge cases: empty input, huge input, wrong types, network failure?
- →Security: secrets, unsanitized input, permissions?
- →Tests: does anything actually verify this still works?
Key takeaways
- AI-generated code is a draft from a confident stranger. Review it that way.
- Look hardest at the edges: empty inputs, missing values, and anything touching auth or money.
- Anything you cannot explain line by line is not ready to ship.
- The review is not a formality — it is the step that makes the speed safe.