https://shipreadyai.dev/audit-ai-generated-code

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# How to audit AI-generated code

To audit AI-generated code, start from the outside and work in: check what anyone can see from your public address, then test data access with a second account, then read the sign-in, payment and data rules the tool wrote. An outside check covers the first step in about twenty seconds.

## Audit steps, in order

- **Look from the outside**
  Run the [free check](/check) on your public address. It reads https, headers, exposed files, keys in client code, open tables and storage, and lists what it could not verify.
- **Fix what was observed**
  Each observed item comes with the evidence line and a fix prompt you can paste into your AI tool. Re-run the check after you fix it.
- **Test data access with two accounts**
  Make two test accounts. With the second one, try to read, change and delete the first one's records. Every attempt should fail.
- **Read the row rules**
  Open each table's rules and confirm they are written per action: read, add, change, delete. A rule that is always true lets everyone in. See [row level security](/glossary/row-level-security).
- **Walk the sign-in flow**
  Try sign-up, sign-in, password reset and sign-out. Check that a reset link only works once and that signed-out pages send you to sign-in.
- **Follow the money**
  If you take payments, confirm access is granted only after the payment provider confirms the charge, and that a refund removes it.
- **Check what you installed**
  Confirm every package your tool added is real and widely used. The [package checker](/tools/package-check) does this from a pasted file.
- **Write down what you did not check**
  Keep a short list of what is still unchecked. It tells you, or the person you hire, where to look next.

## What each step needs

| Step | Who can do it |
| --- | --- |
| Look from the outside | The free check, no account |
| Two account test | You, in about fifteen minutes |
| Row rules, sign-in, payments | You if you can read the code, or a [Launch Review](/launch-review) |
| Package names | The package checker |

## Questions people ask

- **What is an AI audit?**
  For an app, it is a planned review of what an AI tool built, before real users or real money depend on it. It focuses on data access, sign-in, payments and anything left exposed.
- **Why do AI projects need an audit?**
  AI tools leave the same gaps often, such as missing row rules and keys in client code. The [vibe coding security risks](/vibe-coding-security-risks) page lists them with public reports.
- **Can I audit AI-generated code myself?**
  Yes, steps one to three need no coding. Steps four to six are easier with someone who reads code.
- **Does an audit prove the app has no problems?**
  No. It lowers the chance you ship a known gap. Anything not checked should be written down, not assumed fine.