Skip to content
Back to AI Coding

AI Security Review

Review diffs for security issues: injection, auth, secrets, path traversal.

Testing & ReviewAdvanced

Why

GitHub's 2024 survey found 92% of US respondents use AI coding tools for test case generation, and 98% of organizations have experimented with AI for tests. Security bugs slip past functional review.

AI with a security-focused prompt + the diff catches common classes (SQLi, XSS, missing auth, hardcoded secrets) before merge, complementing SAST tools.

When

Use on PRs touching auth, input handling, SQL, file access, or crypto. Skip for pure UI.

How

1. Feed the diff + the auth/input/SQL context. 2. Ask: "review for injection, missing auth, hardcoded secrets, path traversal; cite lines". 3. For each finding: confirm, fix, and add a regression test. 4. Cross-check with your SAST tool; reconcile differences. 5. Block merge on confirmed high-severity findings.

Example

Diff: db.query(`SELECT * FROM users WHERE name LIKE '%${q}%'`) AI: "SQL injection at users.ts:18 — q interpolated into query. Fix: parameterize." Also: "no auth check on this route — add requireAuth middleware." Fix both; add regression test for the injection; SAST confirms clean.

Common Problems

  • ⚠Error: Cannot find module 'jest' / 'vitest' → run `npm install --save-dev vitest` (or jest); verify the test script in package.json.
  • ⚠Error: "Test timed out after 5000ms" → increase `testTimeout` in config or await the async operation; common with network calls.
  • ⚠AssertionError: expected undefined to equal 'x' → the mock returned undefined; verify the mock setup returns the expected shape.

Best Practices

  • ✓Cross-check AI findings with a SAST tool; reconcile differences.
  • ✓Block merge on confirmed high-severity security findings.
  • ✓Measure the outcome with a concrete metric (time saved, defect rate, test coverage) so the practice can be justified and improved.

FAQ

What is AI Security Review?

Review diffs for security issues: injection, auth, secrets, path traversal. It helps developers quickly grasp the core value and use cases of AI Security Review.

How do I get started with AI Security Review?

To get started with AI Security Review, focus on these points first: Feed the diff + the auth/input/SQL context.

What are common mistakes with AI Security Review?

Common mistakes when using AI Security Review include: Error: Cannot find module 'jest' / 'vitest' → run `npm install --save-dev vitest` (or jest); verify the test script in package.json.; Error: "Test timed out after 5000ms" → increase `testTimeout` in config or await the async operation; common with network calls.; AssertionError: expected undefined to equal 'x' → the mock returned undefined; verify the mock setup returns the expected shape..

What are the best practices for AI Security Review?

Best practices for AI Security Review include: Cross-check AI findings with a SAST tool; reconcile differences.; Block merge on confirmed high-severity security findings.; Measure the outcome with a concrete metric (time saved, defect rate, test coverage) so the practice can be justified and improved..

How do I learn more about AI Security Review?

Start with the official docs, then search real-world examples on GitHub. Validate patterns in a small scratch repo before applying them to production code.