{"slug": "i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking", "title": "I Let AI Write My Code — Here Are 10 Things I Never Let It Do Without Checking", "summary": "A developer who relies heavily on AI coding assistants shared 10 critical safeguards they never skip before using AI-generated code. The rules include never running commands without understanding them, verifying dependencies, protecting secrets, reviewing authentication and database migrations, preferring small fixes, and ensuring code is fully understood before merging. The developer emphasizes that while AI accelerates development, developers must own and verify the final result.", "body_md": "I Let AI Write My Code — Here Are 10 Things I Never Let It Do Without Checking\n\nAI writes a lot of my code now.\n\nIt helps me:\n\nAnd yes, it saves a huge amount of time.\n\nBut there is one rule I never break:\n\nAI can write the code. I still have to own the result.\n\nThat means I do not blindly copy, run, merge, or deploy whatever it gives me.\n\nAI is fast.\n\nBut it can also be confidently wrong.\n\nHere are 10 things I never let AI do without checking first.\n\nAI may suggest commands like:\n\n```\nnpm install some-package\n```\n\n`\n\nor:\n\n`bash`\n\nrm -rf some-folder\n\nor:\n\n`bash`\n\ngit reset --hard\n\nSometimes the command is correct.\n\nSometimes it is destructive.\n\nBefore I run anything, I ask:\n\nIf I do not understand the command, I do not run it.\n\nSimple rule:\n\nNever execute a command just because AI says it is safe.\n\nAI can suggest dependencies that look completely real.\n\nFor example:\n\n`bash`\n\nnpm install react-super-auth-helper\n\nBut is that package actually trustworthy?\n\nI check:\n\nA package name that sounds professional is not enough.\n\nAlways verify dependencies yourself.\n\n`.env`\n\nFile Carelessly\nYour `.env`\n\nfile may contain things like:\n\n`text`\n\nDATABASE_URL=\n\nSTRIPE_SECRET_KEY=\n\nOPENAI_API_KEY=\n\nAWS_SECRET_KEY=\n\nJWT_SECRET=\n\nThese are not normal pieces of code.\n\nThey are secrets.\n\nI do not casually paste them into prompts.\n\nAnd I do not let AI move them into client-side code.\n\nThis is especially dangerous in frontend projects.\n\nFor example:\n\n`javascript`\n\nconst secretKey = \"sk_live_...\";\n\nIf that ends up in browser code, your secret may become public.\n\nRule:\n\nSecrets stay secret.\n\nAuthentication code can look simple:\n\n`text`\n\nLogin\n\n↓\n\nCheck password\n\n↓\n\nCreate token\n\n↓\n\nDone\n\nBut real authentication involves much more:\n\nAI may generate code that works in a demo but is unsafe in production.\n\nSo whenever AI touches:\n\nI review it carefully.\n\n\"It works\" is not enough for authentication.\n\nThis one can hurt.\n\nAI might generate:\n\n`sql`\n\nDROP COLUMN phone_number;\n\nor:\n\n`sql`\n\nALTER TABLE users ...\n\nOne wrong migration can destroy real data.\n\nBefore running a migration, I check:\n\nNever treat production data like test data.\n\nDatabase changes deserve a second look. Always.\n\nSometimes I ask AI:\n\n\"Fix this bug.\"\n\nAnd it responds by changing 15 files.\n\nThat is where things get dangerous.\n\nA small bug may suddenly turn into:\n\nI prefer small changes.\n\nInstead of:\n\n\"Rewrite the whole feature.\"\n\nI ask:\n\n\"Find the cause first.\"\n\nThen:\n\n\"Show me the smallest possible fix.\"\n\nSmall changes are easier to understand and easier to reverse.\n\nThis is probably my biggest rule.\n\nIf AI generates:\n\n`javascript`\n\nconst result = data.reduce((acc, item) => {\n\n// 25 lines of logic\n\n}, {});\n\nand I do not understand why it works, I do not merge it yet.\n\nI ask AI:\n\nExplain this code line by line.\n\nThen I ask myself:\n\nCould I explain this to another developer?\n\nIf the answer is no, I am not ready to own that code.\n\nBecause someday that code will break.\n\nAnd when it breaks, AI may not be there to save you.\n\nNever keep code you completely do not understand.\n\nAI is great at writing tests.\n\nBut here is something funny:\n\nAI can write broken code and then write tests that happily approve that broken code.\n\nFor example:\n\n``text`\n\nWrong function\n\n+\n\nGreen checkmark\n\n`\n\nA passing test does not automatically mean the feature is correct.\n\nI check whether the tests include:\n\nTests should challenge the code.\n\nNot just confirm the happy path.\n\nAI can suggest code like:\n\n`javascript`\n\nif (user) {\n\nreturn sensitiveData;\n\n}\n\nBut maybe the real question should be:\n\n`javascript`\n\nif (user.role === \"admin\") {\n\nreturn sensitiveData;\n\n}\n\nSecurity bugs often come from missing checks, not broken syntax.\n\nWhenever AI touches:\n\nI ask:\n\nWhat could an attacker do here?\n\nThat one question often reveals things the first answer missed.\n\nAI finished the feature.\n\nEverything looks good.\n\nNow deploy?\n\nNot yet.\n\nMy basic flow is:\n\n`text`\n\nAI writes code\n\n↓\n\nI review it\n\n↓\n\nRun locally\n\n↓\n\nRun tests\n\n↓\n\nCheck the diff\n\n↓\n\nTest edge cases\n\n↓\n\nThen deploy\n\nThis adds a few minutes.\n\nBut those few minutes can save hours of debugging later.\n\nProduction is not the place to discover that AI misunderstood your request.\n\nI do not think AI-generated code is the problem.\n\nThe problem is **AI-generated code that nobody reviewed**.\n\nAI is extremely useful when it acts like:\n\nBut I do not treat it like an engineer who should have unlimited permission.\n\nThere is still one person responsible for the final result.\n\n**You.**\n\nI try to follow this:\n\nLet AI do the typing. Keep the judgment.\n\nAI can write 200 lines in seconds.\n\nGreat.\n\nBut I still want to know:\n\nIf I cannot answer those questions, I am not done yet.\n\nYou do not need to stop using AI.\n\nJust add a review step.\n\n`text`\n\nAsk AI\n\n↓\n\nGenerate\n\n↓\n\nRead\n\n↓\n\nUnderstand\n\n↓\n\nTest\n\n↓\n\nReview diff\n\n↓\n\nMerge\n\nThat small habit makes a huge difference.\n\nAI is making software development much faster.\n\nAnd I love that.\n\nBut faster coding does not remove the need for judgment.\n\nIf anything, it makes judgment more important.\n\nBecause when code becomes easy to generate, the real skill becomes knowing:\n\nWhat should I trust?\n\nWhat should I test?\n\nWhat should I never allow without checking?\n\nUse AI.\n\nLet it save you time.\n\nLet it write boring code.\n\nLet it help you debug.\n\nBut do not hand over your brain with your keyboard.\n\n**AI can write the code. You still own what happens next.**\n\nWhat is one thing you never let an AI coding agent do without checking first?\n\nI am curious to hear what other developers would add to this list.\n\n```", "url": "https://wpnews.pro/news/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking", "canonical_source": "https://dev.to/darun_karasabir_b79602fd/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking-cbk", "published_at": "2026-08-29 10:05:15+00:00", "updated_at": "2026-08-29 10:19:16.326302+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools", "ai-safety"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking", "markdown": "https://wpnews.pro/news/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking.md", "text": "https://wpnews.pro/news/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking.txt", "jsonld": "https://wpnews.pro/news/i-let-ai-write-my-code-here-are-10-things-i-never-let-it-do-without-checking.jsonld"}}