AI-generated code
AI code audit: who reviewed what the AI wrote?
Cursor, GitHub Copilot, Lovable, Bolt.new or v0 deliver in hours what used to take weeks. A security review is not part of the package. Our code audit reads the code the AI wrote and finds missing checks, exposed keys and risky packages.
We read the code, we attack nothing. The code audit is not a penetration test.
Product names are trademarks of their respective owners. We are not affiliated with these providers.
Why AI code has its own flaws
AI assistants write code that works. Whether it is secure, they rarely check. Typical patterns in AI code:
- Missing authorisation checks: the route checks that someone is logged in, not that the data belongs to them.
- Hard-coded secrets: API keys and tokens end up in the source code or in the frontend.
- Outdated or invented packages: dependencies with known CVEs, or package names that do not exist and that anyone can register.
- Missing input validation: input flows unchecked into database queries, HTML or shell commands.
- Overly permissive rules: CORS for any origin, missing or too broad row-level security policies, for example in Supabase.
ExampleFictitious example, no customer data.
API route without authorisation check
- Location
app/api/invoices/[id]/route.ts, line 14- Finding
- The route only checks that a user is logged in. Any customer can fetch other customers’ invoices by their ID.
- Recommendation
- Check on the server that the invoice belongs to the user’s account before the query.
- CVSS 6.5
- CWE-639
- OWASP A01:2025
The typical mistakes in detail: Vibe coding: how secure is AI-generated code?
What we check: OWASP Top 10:2025
Every finding is mapped to a category of the OWASP Top 10:2025 and rated with CVSS 3.1. Typical categories in AI code:
A01:2025 Broken Access Control
Missing ownership and role checks in API routes and server functions.
A02:2025 Security Misconfiguration
Open CORS rules, debug mode, overly broad database policies.
A03:2025 Software Supply Chain Failures
Dependencies with known CVEs, abandoned or invented packages.
A04:2025 Cryptographic Failures
Home-made encryption, weak password hashes.
A05:2025 Injection
SQL, HTML and shell commands built from unchecked input.
A07:2025 Authentication Failures
Hard-coded keys, insecure sessions and tokens.
How it works
- 01
Hand over the code
Read access to the repository or an encrypted archive. NDA first, plus a DPA if the code contains personal data.
- 02
AI agents review
Tools such as semgrep, gitleaks and osv-scanner provide signals, specialised agents read the context.
- 03
Quality gate
A second agent tries to refute every finding. Only what is proven goes into the report.
- 04
Report
Findings with file and line, CVSS rating and a concrete recommendation, in 2 business days.
Every step in detail: Methodology
What you get
- Findings with their location in the code, file and line
- Rating with CVSS 3.1, CWE and OWASP Top 10:2025
- Prioritised action plan with a concrete recommendation per finding
- Raw data from every tool
Code audit, app audit or both?
The code audit finds the causes in the source code, for €890 net. The app audit runs automated tests against the live application with two test accounts, for €490. The full audit combines both and proves code findings in the running app, for €1,690.
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Launch coming up? Pre-launch security audit
Frequently asked questions
Is AI-generated code less secure than hand-written code?
Not as a rule. But AI assistants readily copy insecure patterns and outdated dependencies, and leave out checks nobody explicitly asked for. We review AI code as strictly as hand-written code.
Which tools do you cover: Cursor, GitHub Copilot, Lovable, Bolt.new, v0?
All of them. We review the code that came out, not the tool. What matters is the language: TypeScript/JavaScript, Python, PHP, Go, Java, Kotlin and C#/.NET with the common frameworks, among others.
Is an automatic scanner like npm audit enough?
No. npm audit reports known flaws in dependencies. It does not see missing authorisation checks, exposed secrets or overly broad database rules. We combine several tools with AI agents that read the context, and every finding is cross-checked.
What does it cost and how long does it take?
The code audit costs €890 net at a fixed price. You receive the report 2 business days after payment and code handover, with Express within 24 hours on business days.
Is my code used to train AI?
No. For the analysis we use Claude by Anthropic (USA); the AI provider does not train on your code. Code uploads are kept in private storage in the EU, and we delete them after completion; the periods are in the privacy policy.
Is this a penetration test?
No. We read the code and attack nothing. A penetration test attacks a running system. The two complement each other.
Using AI code in production? Have it reviewed.
All prices net, plus VAT. Businesses only. Our terms and conditions apply.