Code that runs is not the same as code that is safe and maintainable. The page can look perfect while a form accepts anything typed into it or a secret key sits where a visitor could read it.
You do not need to read every line. You need to know what to look for, how to test it from the outside, and when to ask a developer for a second opinion.
AI-generated code can work and still be weak in places that are easy to miss: unchecked input, exposed secrets, silent errors and tangled structure. A short checklist, plus a second pass by the AI itself, catches most of it.
Start with what a visitor can see
Open your site as a stranger would. Try the forms with empty values, very long text and unexpected characters. Check that private pages ask for sign-in and that the browser page source and network tab do not show passwords or private keys.
- Submit each form empty and with nonsense input.
- Open admin links while signed out.
- Search the page source for keys and tokens.
Review the risky areas first
Not all code deserves equal attention. Focus on the places where mistakes cost most: sign-in, payments, anything that reads or writes customer data, and anything that accepts uploads.
- Input is validated on the server, not only in the browser.
- Secrets live in environment settings, never in the code.
- Users can only see and change their own records.
- Errors show a friendly message, not internal details.
Look at structure and maintainability
Even safe code becomes expensive if every change breaks something else. Prefer small files with one job each, clear names and no copy-pasted blocks. If one file has grown very large, ask for it to be split before adding more features.
Use the AI as a reviewer, then a human for the critical parts
Ask the AI to review its own work against a specific list, such as validation, access control and error handling, and to explain what it found. This is useful but not a guarantee, so for payments or sensitive data have an experienced developer read those parts.
Example prompt to Uttra: "Review the booking form and admin page. Check input validation on the server, that only signed-in admins can see requests, and that no secret is exposed. List problems, then fix them without changing the design."