Stop Trusting AI Code: A Sanity Check Guide

Stop treating AI-generated code like a divine revelation just because the UI doesn't crash on the first load. The most dangerous part of using an LLM agent isn't the blatant syntax error—it's the "polished lie." Everything looks gorgeous, the buttons click, and you're convinced you're a 10x developer, while underneath, the code is a chaotic mess of security holes and fragile logic.

I've learned the hard way that there is a massive gap between "this produces the screen I asked for" and "this is actual engineering." AI is a master of the demo; it's significantly worse at respecting your app's systemic boundaries.

If you're using AI for your AI workflow, here is the "don't get fired" checklist for reviewing changes.

The "User Contract" Filter

Before you even look at the diff, write down exactly what the feature is supposed to do in one sentence.

Example: "A signed-in user can save a private note and see only their own saved notes after refreshing."

If you just tell the AI "add notes," you're asking for trouble. Once you have your contract, force the AI to point to the exact lines where ownership is enforced and where the data persists. If it starts rambling instead of giving you line numbers, the code is a gamble.

The 5-Point Post-Mortem Checklist

• The Data Path: Trace the data from the input field to the DB and back. AI loves to update a form and a query in two different ways, leaving the bridge between them broken. Is the data normalized? Is it actually loading from the source, or is it just hallucinating a local state?
• Authorization (The "Hidden Button" Fallacy): Hiding a button in the UI is not security. Check the server-side authorization. If User A can change an ID in a request and suddenly see User B's private data, your "feature" is actually a security breach.
• The "Happy Path" Bias: AI is an optimist; it assumes the network never fails and users never type nonsense. Check the failure paths. What happens during a timeout? Does a failed save trigger a success toast? If the loading state doesn't clear on an error, your UI is now a brick.
• The Change Surface: Make the AI list every single file, schema, and environment variable it touched. This is how you catch the "silent killer"—when a tiny feature request quietly rewrites a shared utility function and breaks three other unrelated pages.
• State Persistence: Ensure the AI isn't just mirroring data in the frontend state to make the demo look fast while the backend is actually returning a 404.

Basically, treat the AI like a junior dev who is incredibly confident but occasionally lies about whether they actually tested the code. Trust, but verify everything.