What a human review
actually changes.
Ten failures we find again and again in applications built with AI coding tools. For each one: the code as the tool wrote it, the code as it should be, and how to check your own project in a couple of minutes.
Every example is illustrative and written for this page. We never publish client code.
§ Critical — fix these first
Critical findings
Each of these can be exploited by someone with no special access and no tooling beyond a browser.
Stripe webhook accepts unverified events
Your webhook route reads the request body and acts on it directly.
Read the fix → CRITICAL Database & dataSupabase Row Level Security is off, or has no policy
Your app works, and the Supabase dashboard shows "RLS disabled" or "No policies" next to your tables.
Read the fix → CRITICAL Exposed credentialsSecret keys shipped to the browser
You have an environment variable named something like NEXT_PUBLIC_OPENAI_API_KEY or VITE_STRIPE_SECRET_KEY.
Admin routes protected only by hiding the button
Your admin area is protected by something like {user.isAdmin && <AdminPanel />}.
Records fetched by ID with no ownership check (IDOR)
Endpoints look like findUnique({ where: { id } }) with the ID taken straight from the URL.
Prices sent from the browser to the checkout
Your create-checkout endpoint accepts amount, price or total in the request body.
§ High — fix these next
High-severity findings
Not immediately exploitable, but they are what turns a working prototype into an application nobody can safely operate.
File uploads with no type, size or ownership checks
Your upload handler takes file.name and file.type and saves the file.
Queries with no index, and the N+1 that follows
Pages that were instant during development take seconds in production, and get slower every week.
Read the fix → HIGH Production readinessErrors caught, logged to nowhere, and swallowed
Your codebase is full of catch (e) { console.error(e) } and you have no error tracking service.
CORS set to allow everything, with credentials on
You have app.use(cors()) or an origin reflected from the request header, plus cookie-based sessions.
Not sure which of these you have?
That is what the free health check is for. Send us the repository and a senior engineer will tell you which of these are in your project, where, and what to fix first.
Get my free health check →Find out where you actually stand.
Free. No obligation. Reviewed by experienced engineers.
Get my free health check →