How to Review AI-Generated Code Before You Merge

Review against the behavior that was requested, not only the explanation the agent wrote afterward. Read all changed files and look for edits outside scope, missing error handling, weakened checks, copied secrets, and assumptions that were not part of the task.

Ask the agent to explain a change you cannot connect to the goal. A concise explanation helps investigation, but the code and evidence decide whether the change is acceptable.

Choose tests based on the code path. Run focused tests first, then type checks, lint, integration tests, or a manual browser flow when they cover behavior the focused test does not. Confirm that test output belongs to the current version of the change.

When changes cross a trust boundary, trace who controls each value and what the server checks before acting. Review authorization separately from authentication. Inspect shell and SQL construction, URL and path handling, HTML output, newly introduced packages, and any secret or personal data that may enter logs.

A useful review record lists changed areas, checks and results, and unresolved limitations. Say “the focused auth suite passed” rather than implying the entire application is correct. If a scanner did not cover generated files, runtime behavior, or a dependency, state that boundary.

ProofCheck scans working-tree changes for selected dependency CVEs, exposed secrets, and unsafe patterns. It reports file-and-line findings for you to investigate. It is a useful signal within that scope, not a substitute for review and not proof that no vulnerability exists.