AI-generated code has hidden security holes

1. Check the problem

Review generated code before merging. Check exposed secrets, input validation, authorisation and dependencies, then test how the changed feature handles rejected input. Keep server credentials out of client bundles.

2. Use the prompt

Do a security pass on this change before I merge. Check for hardcoded secrets or API keys, missing env-var validation, unsafe handling of user input, and dependencies with known vulnerabilities. List each issue with file and line, rate it by severity, and show the minimal fix. Change nothing else.

3. Verify the fix

Review the proposed diff, run the relevant checks and exercise the original failing flow before merging.