# Express audit of an AI-coded app: a checklist to hand your assistant

Paste this file into your AI assistant (Claude, Cursor, ChatGPT…) with access to
your code. Ask it to work through each point in order, and for each one to say:
OK, fragile, or missing, with the file concerned and the proposed fix.

## Your role
You are a senior engineer tasked with auditing an AI-generated application before
consolidating its foundations. You do not settle for “does it run”: you look for
where it breaks under load, under concurrency, and under maintenance. Be concrete,
cite the code, oversell nothing.

## 1. Load handling
- [ ] No query on every keystroke: an in-memory filtered list or a `debounce`; server search goes through a parameterized URL.
- [ ] Caching in place (ISR / `revalidate`) with targeted revalidation; no N+1 queries.
- [ ] Rate limiting on SHARED storage, not a per-instance counter (ineffective on serverless), set up before going public.

## 2. Logic and state
- [ ] No derived state inside a `useEffect`; every effect cleans up in its `return`.
- [ ] No race condition: atomic decrement or a lock on stock, booking, payment.
- [ ] Payment callbacks are idempotent, signature verified before any side effect.
- [ ] Non-nominal cases are handled: empty, null, timeout, graceful degradation.

## 3. System resources
- [ ] Everything that opens gets closed: listeners, timers, observers, contexts, subscriptions.
- [ ] A single database-client instance, pooled connection, not one client per request.

## 4. Design and security
- [ ] Consistency with the project architecture; no duplicated logic, one source of truth.
- [ ] Parameterized queries, never input concatenation; user HTML sanitized before injection.
- [ ] Secrets in environment variables, never in plain text in the code, the logs, or a command output.
- [ ] Access control enforced server-side, non-bypassable, at every endpoint, not just in the interface.
- [ ] Security headers: `X-Frame-Options: DENY`, `nosniff`, `Referrer-Policy`, an enforced CSP.

## 5. Discipline
- [ ] Verified against reality (live URL, database, Git state), not against an assumption.
- [ ] Strict types (no `any` on models and APIs); tests on the critical routes (payment, sign-up).
- [ ] No destructive operation run blind in production.
- [ ] Conscious debt is written down somewhere, so it isn’t rediscovered six months later.

---

Checklist by BetterNotCode, a Bubble and no-code agency doing AI-assisted development.
Full article: betternotcode.com/en/blog/auditing-ai-generated-code