AI-Generated Code Needs Security Too: Here’s My Approach

AI can write code in seconds. But shipping secure code still requires engineering judgment.

A few years ago, most of us searched Stack Overflow when we got stuck.

Today, many developers ask AI first.

Whether it's writing a Python script, generating a Terraform module, creating a GitHub Actions workflow, or explaining a Kubernetes manifest, AI has become part of the modern engineering workflow.

I'll admit it — I use AI almost every day.

It helps me brainstorm ideas, understand unfamiliar technologies, automate repetitive tasks, and accelerate development.

But there's one thing I've learned very quickly.

Just because AI can generate code doesn't mean that code is ready for production.

AI is incredibly fast.

Security still requires careful thinking.

AI Is a Great Starting Point, Not the Final Answer

One of the biggest mistakes I see is treating AI-generated code as if it has already been reviewed.

It hasn't.

AI predicts patterns.

It doesn't understand your architecture, business requirements, compliance obligations, or risk tolerance.

I've seen AI generate code that:

• Uses overly permissive IAM permissions
• Hardcodes configuration values
• Skips input validation
• Doesn't handle exceptions properly
• Recommends outdated libraries
• Exposes unnecessary information in logs

None of those issues mean AI is bad.

They simply remind us that every generated solution still needs human review.

I Review AI-Generated Code Like Any Other Pull Request

Whether the code comes from AI or another engineer, my review process doesn't change.

I ask questions like:

• Does this follow the principle of least privilege?
• Are secrets handled securely?
• Could this introduce a security vulnerability?
• Is sensitive information exposed?
• Does this align with our security standards?
• Is the code actually maintainable?

If the answer isn't clear, it doesn't move forward.

AI shouldn't lower our review standards.

It should make those reviews more productive.

Security Starts Before Deployment

One thing I appreciate about DevSecOps is that security isn't a final checkpoint.

It's built into the development lifecycle.

The same principle applies to AI-generated code.

Before anything reaches production, I expect it to go through:

• Code review
• Static security analysis
• Dependency scanning
• Infrastructure validation
• Secret detection
• Automated testing

AI-generated code should meet exactly the same quality standards as manually written code.

No exceptions.

Context Is Something AI Doesn't Have

One thing AI can't fully understand is why a decision was made.

Maybe a service has limited internet access because of regulatory requirements.

Maybe an application uses a specific encryption method for compatibility.

Maybe a permission exists because another system depends on it.

Those decisions come from understanding the business, the architecture, and the people using the system.

That's context.

And context is where experienced engineers make the biggest difference.

AI Doesn't Own the Outcome

This is probably the most important lesson I've learned.

If AI suggests an insecure Terraform policy and it reaches production…

AI isn't responsible.

The engineering team is.

If AI generates vulnerable code that later causes an incident…

AI doesn't attend the post-incident review.

Engineers do.

That's why accountability never changes, even if the way we write code does.

The Best Results Come From Collaboration

I don't think the future is AI versus engineers.

I think it's AI working alongside engineers.

AI helps me:

• Explore ideas faster
• Generate repetitive code
• Explain unfamiliar syntax
• Speed up documentation
• Automate routine tasks

Then I apply something AI doesn't have:

Experience.

Architecture.

Risk assessment.

Business context.

Critical thinking.

That's where secure software is built.

My Perspective

AI has already changed how we develop software.

I believe it will continue changing how we build cloud platforms, automate deployments, and improve developer productivity.

But one thing shouldn't change.

Every line of code — whether written by a developer or generated by AI — deserves the same level of security review before it reaches production.

Because attackers don't care who wrote the code.

They only care that a vulnerability exists.

Final Thoughts

AI is one of the most powerful productivity tools engineers have ever had.

But productivity should never come at the cost of security.

The goal isn't to replace secure engineering practices.

The goal is to strengthen them.

The engineers who stand out won't be the ones who generate the most code.

They'll be the ones who know how to build secure, reliable systems, regardless of where that code came from.

Because in the end…

AI can generate code. Engineers are still responsible for earning trust.