Security Checks to Run Before Merging AI-Generated Code

Pre-merge security checklist

• Validate all external inputs
• Confirm auth checks on privileged actions
• Verify secrets are read from secure stores
• Review dependency additions
• Ensure security tests cover changed paths

Diff hotspots

Pay special attention to:

• token/session handling
• SQL or query construction
• file and path operations
• webhook and callback processing

Automation support

Use SAST and secret scans in CI, but require human review for risky flows. Automation catches patterns, humans catch context.

Merge policy

For high-risk areas, require two approvals: one domain owner and one security-aware reviewer.