Lockfiles are treated as generated noise in most code reviews, but a tampered package-lock.json or pnpm-lock.yaml can silently swap a legitimate package for a malicious one without touching any source file.
A practical pre-production security checklist for AI-assisted developers who move fast and may have skipped the boring-but-critical basics: secrets, dependencies, error handling, and more.
Passing req.body directly to an ORM update call is the mass assignment vulnerability, and it appears in almost every AI-generated CRUD tutorial. This article explains the exploit and the DTO validation pattern that prevents it.
Large language models hallucinate package names, and attackers register those names and wait. Blindly copying an AI-suggested install command is a genuine supply chain risk that most teams have not considered.
console.log strings are invisible to log aggregators. Switching to structured JSON logging with consistent fields is the single change that most improves the operability of AI-assisted projects.
AI coding assistants write production code fast, but they also reproduce insecure patterns at scale. Here is a practical process for auditing AI-generated code before it ships.
When you ask an AI assistant to add authentication to an Express app, the generated code frequently registers the middleware after the route handler. A single out-of-order line can leave admin endpoints completely unprotected.
AI assistants default to string interpolation when building queries because concatenation dominates their training data. The result is production code that skips parameterised queries entirely and hands attackers a clear path in.
MD5 and SHA-1 password hashing, short JWT secrets, and ECB mode encryption appear repeatedly in AI-generated auth code because the models were trained on a decade of legacy tutorials. This article identifies the patterns and the correct replacements.