Security checklist for AI-written pull requests
The security pass a champion runs on a pull request an assistant wrote: questions to ask of the diff, grouped by area. Use it next to your normal review, not instead of it.
Dependencies
- Does every new package name exist, and is it the one you meant? Assistants invent plausible names, and attackers register them (slopsquatting).
- Did the lockfile change by more than the PR explains? Read the new entries, not just the manifest.
- Is a new dependency pinned, and is it worth its size and maintainers for what it does here?
Secrets
- Is a key, token or password in the code, a config file, a test fixture or a log line?
- Does anything secret end up in the browser bundle? Frontend environment files ship to every visitor.
- Does an API key come from the request, so a caller can make you spend on their behalf or swap the target?
Access control
- Does every new route or handler check who is calling, and is that check above the first early return?
- Does it check that this caller may touch this record, not only that they are signed in?
- Did a refactor (guard clauses, a removed cache write, a renamed role) change who gets through?
Untrusted input
- Is SQL, a shell command, a file path or HTML built from input by string formatting?
- For uploads and archives: can a name with
..or an absolute path write outside the target folder? - Is a redirect target taken from the request without checking it stays on your site?
Tokens and webhooks
- Is a JWT verified, or only decoded?
- Is a webhook's signature checked before its body is used, and does a failed check stop the request?
- Are reset tokens and session ids generated with enough randomness, and compared in constant time?
LLM features
- Can user content reach the system prompt or a tool's arguments without validation?
- Can a tool call act (refund, delete, send) without a check that a person would have made?
- Is the model's output treated as untrusted before it is rendered, stored or run?
The human checkpoint
- Who reviewed this PR for security, by name? An AI reviewer's approval is input, not the review.
- Is there a test that fails if the security check is removed, not only one that passes when it is there?
Why the first item matters: Slopsquatting, the attack your review should catch and the 2026 update. For the general review, see the code review checklist.
Practise
Run the checklist on PRs with a planted security bug.
The security champions set: eight PRs, two per stack. Free, no signup.
Open the security set →