Code review
AI-generated code reviewed by engineers
Functions, endpoints, scripts — senior engineers validate logic, security, and edge cases. Not just syntax: real review for production code.
Functions, endpoints, scripts — senior engineers validate logic, security, and edge cases. Not just syntax: real review for production code.
1 def login(username: str, password: str):
2 user = db.query(username)
3 if user and user.password == password:
4 token = jwt.encode({"user": user.id})
5 return {"token": token}
6 return {"error": "Invalid credentials"}Line 3: user.password == password — compares plaintext. Use bcrypt.checkpw() or equivalent. This is a critical vulnerability.
Line 3: Short-circuit and leaks whether user exists via response time. Use hmac.compare_digest() or always run password check regardless of user existence.
Line 4: jwt.encode() called without explicit secret key — relying on default or global. Pass settings.JWT_SECRET explicitly. Also missing algorithm and expires parameters.
AI-generated functions reviewed for logic correctness, error handling, and edge case coverage before merging.
Auth, payments, data handling — senior engineers verify security posture of AI-generated critical paths.
Review AI-generated API endpoints for input validation, rate limiting, auth, and proper error responses.