How to security-review AI-generated code (the 5 patterns to look for)

What it is

Cursor, Copilot, Lovable, Bolt, v0, Replit, Claude Code, and similar AI coding assistants generate code from prompts + retrieved context. Their training data emphasizes happy-path correctness over security-path correctness; their defaults reflect the canonical examples in their training corpus. The result is code that runs and looks right but ships specific bug classes the human reviewer is meant to catch — and rarely does.

Vulnerable example

// app/api/users/[id]/route.ts — Cursor wrote this
// PATTERN 1: trusts params.id without ownership check
export async function GET(req: Request, { params }: { params: { id: string } }) {
  const user = await db.from("users").select("*").eq("id", params.id).single();
  return Response.json(user);
}

// app/auth/login/route.ts — Copilot wrote this
// PATTERN 2: leaks user existence via error message
export async function POST(req: Request) {
  const { email, password } = await req.json();
  const user = await db.from("users").select("*").eq("email", email).single();
  if (!user) return new Response("user not found", { status: 404 });
  if (user.password !== password) return new Response("wrong password", { status: 401 });
  // ...
}

// app/api/upload/route.ts — Lovable wrote this
// PATTERN 3: trusts client-supplied content type
export async function POST(req: Request) {
  const formData = await req.formData();
  const file = formData.get("file") as File;
  await fs.writeFile(`./uploads/${file.name}`, await file.arrayBuffer());
  return Response.json({ ok: true });
}

// lib/openai.ts — Bolt wrote this
// PATTERN 4: API key inline literal (will be moved later, fingers crossed)
const client = new OpenAI({ apiKey: "sk-proj-Ab12...XyZ9" });

// middleware.ts — v0 wrote this
// PATTERN 5: matcher does not match the routes you think
export const config = { matcher: "/admin/:path*" };
// (you have admin routes at /api/admin/* — middleware never runs)

Fixed example

// PATTERN 1 fix: ownership check
export async function GET(req: Request, { params }: { params: { id: string } }) {
  const session = await getAuthenticatedUser(req);
  if (!session) return new Response(null, { status: 401 });
  const user = await db.from("users").select("*").eq("id", params.id).single();
  if (!user.data || user.data.id !== session.id) {
    return new Response(null, { status: 404 });  // 404 not 403 — don't reveal existence
  }
  return Response.json(user.data);
}

// PATTERN 2 fix: generic error
export async function POST(req: Request) {
  const { email, password } = await req.json();
  const user = await db.from("users").select("*").eq("email", email).single();
  if (!user.data || !await verifyPassword(password, user.data.passwordHash)) {
    return new Response("invalid credentials", { status: 401 });  // same error for both cases
  }
  // ...
}

// PATTERN 3 fix: explicit content-type + filename validation
export async function POST(req: Request) {
  const session = await getAuthenticatedUser(req);
  if (!session) return new Response(null, { status: 401 });

  const formData = await req.formData();
  const file = formData.get("file") as File;

  // Validate content type against allowlist
  const ALLOWED = ["image/png", "image/jpeg", "image/webp"];
  if (!ALLOWED.includes(file.type)) {
    return new Response("unsupported file type", { status: 400 });
  }

  // Sanitize filename — never trust client-supplied path components
  const safeName = `${session.id}-${crypto.randomUUID()}.${file.type.split("/")[1]}`;
  await fs.writeFile(`./uploads/${safeName}`, await file.arrayBuffer());
  return Response.json({ filename: safeName });
}

// PATTERN 4 fix: env var only, never inline
const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY! });

// PATTERN 5 fix: matcher includes /api
export const config = { matcher: ["/admin/:path*", "/api/admin/:path*"] };

How Securie catches it

// PATTERN 1 fix: ownership check
export async function GET(req: Request, { params }: { params: { id: string } }) {
  const session = await getAuthenticatedUser(req);
  if (!session) return new Response(null, { status: 401 });
  const user = await db.from("users").select("*").eq("id", params.id).single();
  if (!user.data || user.data.id !== session.id) {
    return new Response(null, { status: 404 });  // 404 not 403 — don't reveal existence
  }
  return Response.json(user.data);
}

// PATTERN 2 fix: generic error
export async function POST(req: Request) {
  const { email, password } = await req.json();
  const user = await db.from("users").select("*").eq("email", email).single();
  if (!user.data || !await verifyPassword(password, user.data.passwordHash)) {
    return new Response("invalid credentials", { status: 401 });  // same error for both cases
  }
  // ...
}

// PATTERN 3 fix: explicit content-type + filename validation
export async function POST(req: Request) {
  const session = await getAuthenticatedUser(req);
  if (!session) return new Response(null, { status: 401 });

  const formData = await req.formData();
  const file = formData.get("file") as File;

  // Validate content type against allowlist
  const ALLOWED = ["image/png", "image/jpeg", "image/webp"];
  if (!ALLOWED.includes(file.type)) {
    return new Response("unsupported file type", { status: 400 });
  }

  // Sanitize filename — never trust client-supplied path components
  const safeName = `${session.id}-${crypto.randomUUID()}.${file.type.split("/")[1]}`;
  await fs.writeFile(`./uploads/${safeName}`, await file.arrayBuffer());
  return Response.json({ filename: safeName });
}

// PATTERN 4 fix: env var only, never inline
const client = new OpenAI({ apiKey: process.env.OPENAI_API_KEY! });

// PATTERN 5 fix: matcher includes /api
export const config = { matcher: ["/admin/:path*", "/api/admin/:path*"] };

Checklist

• Every API route with `params.id` checks ownership against the authenticated session.
• Every login / password-reset / signup route returns generic errors that do not reveal user existence.
• Every file upload validates content type from server-side inspection (not client-supplied), sanitizes the filename, and bounds the storage path.
• Every secret reads from `process.env.NAME!` — never an inline literal, never a `NEXT_PUBLIC_` variable.
• Every middleware matcher is tested with `curl` against the routes it's supposed to protect — including `/api/...` routes the AI may have missed.
• Every form-submitting route validates the input shape with Zod / Valibot / similar BEFORE any database operation.
• Every email-or-token-based flow includes expiry + single-use + constant-time comparison.

FAQ

Related guides