How to Review and Test AI-Written Code

In short: read every line, run it on a small example, test the edge cases, check imports are real, and scan for secrets and security issues.

Why you must review

An AI predicts likely code. It does not run it for you unless you ask an agent to. It can miss edge cases, use an old API or invent a library. You own the code you ship, not the AI.

What to look for

• Logic errors: right shape, wrong answer (off-by-one, wrong condition).
• Missing edge cases: empty list, zero, null, very large input.
• Made-up APIs: a function or package that does not exist. Always check imports.
• Old APIs: a method that was renamed or removed.
• Security issues: SQL built by joining strings, secrets in code, no input checks.
• Licence risk: a big block that looks copied from a known project.

How a review flows

Worked example: a hidden bug

We asked an AI for “a Python function for the average of a list”. It gave this:

def average(nums):
    return sum(nums) / len(nums)

python -c "from buggy import average; average([])"
# -> ZeroDivisionError: division by zero

It works for normal lists. It crashes on an empty list. We asked: “Handle an empty list by returning 0.0, add type hints and a test.”

def average(nums: list[float]) -> float:
    """Average of a list. Empty list returns 0.0 instead of crashing."""
    if not nums:
        return 0.0
    return sum(nums) / len(nums)

from fixed import average

def test_normal():
    assert average([2, 4, 6]) == 4
def test_empty():
    assert average([]) == 0.0

pytest -q
# -> 2 passed

How to review, step by step

1. Read it line by line. If a line is unclear, ask the AI “explain line 4 in simple words”.
2. Run it on one small example where you already know the answer.
3. Try edge cases: empty, zero, negative, null/None, very long input.
4. Ask the AI for tests, then read the tests too. A test that checks nothing is useless.
5. Check every import on the official package site (PyPI, npm, Maven Central).
6. Scan for security: no hard-coded keys, use parameterised SQL, validate user input.
7. Run your linter and full test suite before you commit.

Install and config: tools that check for you

1. Python: pip install pytest ruff then run ruff check . and pytest -q.
2. JavaScript/TypeScript: Node 20+ has a built-in test runner: node --test. Add ESLint with npm init @eslint/config@latest.
3. Java: JUnit 5 with Maven (mvn test) or Gradle (gradle test).
4. Secrets: turn on GitHub secret scanning and push protection in repo Settings → Code security.
5. CI: run the same lint + test commands in GitHub Actions on every pull request, so AI code is checked every time.

Quick quiz

Save tokens and money

Do not paste the whole project for review. Select only the changed function and ask “find bugs and missing edge cases”. Run linters and tests locally first, they are free, then ask the AI only about real failures.

Save these cards