HOW-TO · DEV

How to review AI pair programming suggestions for security vulnerabilities before accepting them

intermediate15 minBy Fredoline Eruo
Target environment
Ubuntu 24.04 · Ollama 0.4.x
PREREQUISITES

AI pair programming generating code suggestions, basic knowledge of common security vulnerabilities

What this does

AI pair programming tools can generate syntactically correct and functionally sound code that nonetheless introduces security vulnerabilities. This guide provides a checklist for reviewing suggested code before accepting it, focusing on the most common vulnerability patterns that AI-generated code is prone to produce. Following this checklist reduces the risk of merging insecure code into the codebase.

Steps

  1. Open the diff view for the AI-proposed change. Read the entire diff before accepting anything.
  2. Check for injection vulnerabilities: look for string concatenation or template literals used in SQL queries, shell commands, file paths, or eval contexts. Flag any unvalidated user input passed into these constructs.
  3. Verify authentication and authorization: confirm that the suggested code does not bypass role checks, expose session tokens, or default to permissive access control.
  4. Inspect dependency imports: ensure the code does not introduce unknown or outdated packages via the AI suggestion.
  5. Look for hardcoded secrets: scan for inline API keys, passwords, tokens, or connection strings in the proposed code.
  6. Verify input validation: check that the code validates and sanitizes all external inputs rather than trusting data from user requests or external APIs.
  7. Run the project's security linter (e.g., ESLint with a security plugin, Bandit for Python) on the affected file.
  8. If no critical issues are found, accept the change. If issues are found, revise the task instruction and resubmit to the AI pair programmer.

Verification

# Run ESLint security rules on the modified file
npx eslint --plugin security src/routes/auth.js
# Expected output: No security violations reported (or empty output with exit code 0)

Common failures

  1. Accepting code with SQL injection: The AI generates a query using string interpolation for a user-supplied value. Example: "SELECT * FROM users WHERE id = " + req.params.id. Solution: always check database interaction code for parameterized queries. If missing, instruct the AI to rewrite using parameterized statements.
  2. Missing authorization checks: AI-generated route handlers perform an action without verifying the user's role or ownership of the resource. Solution: add an explicit authorization check after the route handler's authentication step. Reference existing middleware patterns in the project.
  3. Hardcoded credentials in example code: The AI includes placeholder credentials or example API keys that are adopted verbatim into production. Solution: search the diff for password, key, token, secret and replace with environment variable references.
  4. Deserialization vulnerabilities: The AI proposes using JSON.parse on untrusted data without schema validation in unsafe contexts. Solution: add a schema validation step before deserialization or use a type-safe deserializer.

Related guides

← All how-to guidesCourses →