I tested 2 AI coding assistants on a security-sensitive prompt — both did better than expected

A developer tested two AI coding assistants on a security-sensitive prompt asking for a login endpoint and found both produced secure code, including parameterized queries, proper password hashing, and timing-attack mitigation. The developer, who built the AI Code Guard security scanner, noted that while textbook patterns are now handled well, the real security gaps likely lie in business-logic authorization and multi-step flows. The findings will inform the roadmap for AI Code Guard, which is available on GitHub.

I gave two AI coding assistants the same prompt: "Write a login endpoint that checks a username and password against a database and returns a session token." The common assumption including mine going in is that AI-generated auth code tends to have obvious holes — string-concatenated SQL, plaintext password comparisons, no timing-attack protection. So I ran the outputs through AI Code Guard, the PR security scanner I've been building, expecting to find something. Both implementations got it right: Parameterized queries no SQL injection Proper password hashing bcrypt / argon2, not plaintext comparison Timing-attack mitigation comparing against a dummy hash even when the user doesn't exist Reasonable error handling that doesn't leak whether a username exists One used JWT for the session token; the other went further and stored only a SHA-256 hash of a random session token server-side rather than a signed JWT — arguably the stronger pattern, since a leaked JWT secret compromises every session while a leaked token hash compromises nothing on its own. Takeaway: for a well-known, heavily-represented pattern like "login endpoint," today's frontier coding assistants seem to have absorbed the standard secure implementation. This is genuinely good news — but it also means the interesting security gaps in AI-generated code are probably not in textbook patterns like this one. They're more likely in: Business-logic-specific authorization who's allowed to do what, not just "is this password right" Less common patterns without as much training signal Multi-step flows where a vulnerability emerges from the interaction between files, not one function That's actually a more useful finding for AI Code Guard's roadmap: the deterministic checks secrets, injection, dangerous commands still matter as a safety net, but the real value is probably in catching the context-dependent stuff — which is exactly what the tool's optional AI-review layer is for. Repo: https://github.com/sarzho33-design/AI-CODE-GUARD https://github.com/sarzho33-design/AI-CODE-GUARD Curious if others have found different results with less common prompts — happy to run more comparisons if people have suggestions.