Treat generated code like an untrusted contribution. Check authorization on the server, validate input at API boundaries, verify ownership checks, and make error responses safe. Search the repository and build artifacts for API keys, tokens, and private data.
Review dependency changes and lockfiles; install from the committed lockfile in CI. Test authentication, roles, file uploads, payment flows, and backups in staging. Use a security baseline such as OWASP ASVS to define what must be verified. OWASP ASVS
Steps to follow
- Scan source, history, and build output for secrets.
- Review dependency and lockfile changes.
- Test access control and input validation as another user.
- Verify backups and rollback before production release.