Blog
Notes from auditing real AI-generated code — the defect patterns we keep seeing, the review habits that catch them, and the prompting mistakes that create them. No fluff, just what we've learned doing the work.
We Audited 30 AI-Generated Codebases: The 5 Bugs That Kept Appearing
The recurring defect patterns we found across real vibe-coded projects — and why the same bugs keep showing up.
2026-10-11 · 8 min read
Why AI Code Passes Tests but Fails Human Review
Green CI, unreadable code: what automated tests miss in AI-generated code and how to catch it.
2026-10-11 · 8 min read
Prompt Patterns That Produce the Worst Code
Vague specs, missing constraints, and 'make it work' loops — the prompting habits that generate the messiest output.
2026-10-11 · 8 min read
A Practical Checklist for Reviewing AI-Written Pull Requests
What to actually check when reviewing AI-generated pull requests, and in what order.
2026-10-11 · 9 min read
Scan Your Lovable Code Before Deploying
The 6 security checks to run on Lovable-generated code before you deploy: exposed Supabase keys, dangerouslySetInnerHTML XSS, tainted data flows, and hallucinated packages — with fixes you can paste back.
2026-10-12 · 9 min read
Bolt.new Pre-Deploy Security Checklist
The 7 security checks that catch what AI-generated React/Next.js code gets wrong — leaked env vars, string-eval sinks, tainted props, and supply-chain surprises — with copy-paste fixes.
2026-10-12 · 9 min read
Replit Agent Code Audit: What to Check Before You Publish
Audit checklist for Replit Agent-generated code: pickle deserialization, eval/exec sinks, SSTI, hardcoded secrets, and agent-specific risks.
2026-10-12 · 10 min read
v0.dev XSS Patterns: What AI-Generated Next.js Gets Wrong
The 5 XSS patterns v0.dev-generated Next.js code keeps repeating — dangerouslySetInnerHTML, innerHTML refs, eval in client components — with paste-ready fixes.
2026-10-12 · 9 min read
Cursor-Generated Code Review Checklist: 11 Checks Before You Merge
The 11-check security review checklist for Cursor-generated code: secrets, taint flows, prototype pollution, prompt-injection sinks, agent-mode diffs, slopsquatted packages, and more.
2026-10-12 · 11 min read
LLM Threats in AI-Generated Apps: RAG Poisoning, Prompt-Injection Sinks, Slopsquatting
The vulnerability classes most scanners miss: RAG poisoning, prompt-injection sinks, insecure LLM output handling, tool-call injection, and slopsquatting (AI-invented packages).
2026-10-12 · 12 min read