DevLoop Runner

Introduction

AI can generate code fast. But "working code" and "secure code" are not the same thing.

AI-generated code is optimized for functional requirements — given an input, produce the expected output, pass the tests. From a security standpoint, though, the output is often incomplete. Insufficient input validation, internal details leaked in error messages, missing authorization checks — these issues don't surface when you only test whether the code "works."

This article maps the security risks in AI-generated code against the OWASP Top 10, provides concrete review checkpoints, and offers practical countermeasures.

Security Risks Lurking in AI-Generated Code

There are several reasons why AI produces code with security gaps.

Vulnerable Code in Training Data

AI models learn from massive code corpora. That corpus includes code that doesn't follow security best practices — Stack Overflow answers, outdated tutorials, legacy codebases. Patterns from these sources can surface in generated output.

Functional Bias

AI prioritizes code that works. When asked to "implement a login feature," it will build the authentication mechanism, but it may not proactively address rate limiting, account lockout, or session management nuances.

Missing Context

AI doesn't fully understand your project's security requirements. Without context like "this application handles financial data" or "this API is publicly accessible," it can't calibrate the appropriate security level.

OWASP Top 10 and AI-Generated Code

The OWASP Top 10 catalogs the most critical web application security risks. Let's examine how they relate to AI-generated code.

A01: Broken Access Control

AI focuses on implementing functionality and can overlook who should be allowed to use it.

Checkpoints:

Are API endpoints protected by authorization checks?
Can users only access their own resources (IDOR prevention)?
Do admin functions have role-based access control?

// Risky: No authorization check
app.get('/api/users/:id/profile', async (req, res) => {
  const profile = await getProfile(req.params.id);
  res.json(profile);
});

// Secure: Authorization check in place
app.get('/api/users/:id/profile', authenticate, async (req, res) => {
  if (req.user.id !== req.params.id && !req.user.isAdmin) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  const profile = await getProfile(req.params.id);
  res.json(profile);
});

A02: Cryptographic Failures

AI may use outdated algorithms or improper configurations for cryptographic operations.

Checkpoints:

Are passwords hashed with bcrypt or Argon2 (not MD5 or SHA-1)?
Is communication encrypted with TLS?
Are cryptographic keys free from hard-coding?

A03: Injection

SQL injection and XSS are among the most common vulnerabilities in AI-generated code.

SQL injection prevention:

// Risky: String concatenation query
const query = `SELECT * FROM users WHERE name = '${userName}'`;

// Secure: Parameterized query
const query = 'SELECT * FROM users WHERE name = $1';
const result = await db.query(query, [userName]);

XSS prevention:

// Risky: Direct rendering of user input
element.innerHTML = userInput;

// Secure: Escaped output
element.textContent = userInput;

A07: Identification and Authentication Failures

AI-generated authentication features may implement the basic mechanism but omit critical details:

Password strength validation
Brute-force protection (rate limiting)
Proper session invalidation
Multi-factor authentication support

Input Validation and Sanitization Checkpoints

Input validation is your most fundamental line of defense. AI-generated code frequently falls short here.

Trust No Input

API endpoints, form fields, URL parameters, HTTP headers — all external input must be validated.

// Validation example using zod
import { z } from 'zod';

const CreateUserSchema = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
  age: z.number().int().min(0).max(150),
});

app.post('/api/users', async (req, res) => {
  const result = CreateUserSchema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ error: result.error.issues });
  }
  // result.data is type-safe and validated
  await createUser(result.data);
});

Sanitization Essentials

Strip or escape HTML tags
Escape SQL special characters (prefer ORMs or parameterized queries)
Prevent path traversal (../ removal)
Validate MIME types and enforce size limits for file uploads

Authentication and Authorization Review

Authentication (who you are) and authorization (what you can do) are distinct concepts, but AI-generated code sometimes conflates them or omits authorization entirely.

Authentication Checklist

Are passwords stored as hashes?
Are JWT expiration times set appropriately?
Is a refresh token mechanism implemented?
Are sessions/tokens invalidated on logout?

Authorization Checklist

Does every endpoint have an authorization check?
Is role-based access control (RBAC) implemented correctly?
Are resource ownership checks in place?
Are authorization decisions made server-side, not client-side?

Preventing Hard-Coded Secrets

AI-generated code can inadvertently include hard-coded secrets.

Common Patterns

// Risky: Hard-coded API key
const apiKey = 'sk-1234567890abcdef';

// Risky: Hard-coded database connection string
const dbUrl = 'postgresql://admin:password123@localhost:5432/mydb';

// Secure: Environment variables
const apiKey = process.env.API_KEY;
const dbUrl = process.env.DATABASE_URL;

Prevention Measures

Use environment variables or a secrets manager
Add .env files to .gitignore
Run secret-scanning tools (e.g., git-secrets) before committing
Check for hard-coded strings during PR review

Security Checks in DevLoop Runner's Test Phase

DevLoop Runner's Dev Run workflow includes security-related verification during the test phase.

Security-Aware Test Scenarios

When AI persona Sumire (QA) designs test scenarios, she includes security-oriented test cases:

Validation tests for malformed input
Rejection tests for unauthorized access
Boundary and edge case tests for security behavior

Detection Through Test Execution

Security-related tests run during the test execution phase. Failures trigger implementation revisions.

That said, DevLoop Runner's testing alone does not guarantee security. Treat it as a baseline check and combine it with professional security audits and penetration testing for production systems.

Security Review Checklist

Here's a consolidated checklist for reviewing AI-generated code.

Input / Output

All user input is validated
Output is escaped appropriately for the rendering context
File uploads have proper restrictions
Error messages do not leak internal details

Authentication / Authorization

Every endpoint's authentication requirement has been verified
Authorization checks are performed server-side
Passwords are properly hashed
Session management is securely implemented

Data Protection

No secrets are hard-coded in the source
Communication is encrypted
Logs do not contain sensitive information
Database queries are parameterized

Dependencies

No known vulnerabilities in used libraries
No unnecessary dependencies added
Library versions are reasonably up to date

Summary

AI-generated code may satisfy functional requirements while leaving security gaps
Use the OWASP Top 10 as a framework to check for access control, injection, and authentication issues
Input validation is foundational — validate all external input without exception
Authentication and authorization are distinct — watch especially for missing authorization checks
Hard-coded secrets are a particularly common problem in AI-generated code
DevLoop Runner's test phase provides baseline checks but is not a substitute for professional security audits
Use checklists to prevent oversights during review

The quality of AI-generated code is improving rapidly, but verifying its security remains a human responsibility. Let AI generate the working code; let humans ensure it's safe. Keeping that division of labor in mind is the foundation of secure AI-assisted development.

Security Best Practices for AI-Generated Code