How to Check Code Written by AI If You're Not a Developer

The project was written by an agent in an evening, it works, it looks ready. The question almost nobody asks themselves: what is under the hood, if you've never read the code. The agent does the task literally and stays silent about what wasn't asked. A security hole or a forgotten check won't show up in the "done" report unless you asked it to look for them separately.

Below is a basic set of checks for those who run a project through an AI agent without development experience. Each item covers its own weak spot, and the tools are free or built in.

Check against a reference, not against a spoken spec

A technical spec is almost never spelled out to the last detail, and the agent fills the gaps the way it sees fit. The difference is closed with an example: give the agent a reference, a finished site, a screen, a piece of text, and ask it to check against that instead of guessing on its own.

Then you can go one step deeper and ask the agent to verify the result itself: take a screenshot, compare it with the reference, and report only when there are zero differences. In this case, how you word the task for the agent matters more than the choice of model.

Code review with a built-in tool

Claude Code has a built-in /code-review command. It checks the changes in the current branch for bugs and logic errors, and the depth of analysis can be set from low to max with a separate parameter. A separate version, /code-review ultra, starts several reviewer agents in the cloud in parallel and rechecks each problem found, so false alarms don't get into the report.

An important caveat: /code-review checks whether the code works technically, not whether it does what the task asked for. For checking against a specification and project standards there is a separate open skill plugin, github.com/mattpocock/skills, installed with the command /plugin install mattpocock-skills right inside Claude Code, and it is part of the official marketplace.

Security check

Almost nobody tells vibe coders about data leaks separately, although mistakes here are the most expensive. Common problems in practice: the .env file with API keys isn't added to .gitignore and goes into a public repository; passwords and keys are pasted straight into the conversation with the agent and stay in the session history instead of a separate protected storage; a service sits on an open port with no limit on login attempts.

Claude Code has a built-in /security-review command for this. It appeared in August 2025 and is available on paid plans without extra setup. It reads the changes in the current branch and looks for vulnerabilities: SQL injection, cross-site scripting, authentication problems, unsafe handling of data.

Separately there is a project from OpenAI, Codex Security, a CLI tool that scans the whole repository at once, builds a threat model, and proposes a patch that a human approves. To run it you need Node.js version 22.13 or newer and Python 3.10 or newer.

Leaks of keys and passwords that already happened in git history are caught by the open gitleaks: it scans the repository for secrets that got in by mistake.

What happens after launch

A code check before release doesn't close the risk on the server after publication. fail2ban automatically bans addresses that brute-force the password to the server. Programs do this around the clock, regardless of whether anyone is personally interested in your particular project.

Real-time monitoring of server resources is covered by the open beszel: CPU, memory, disk, network, docker containers, and alerts on a load spike, so the problem is visible before it turns into an incident.

Who needs this and who it's too early for

This set is needed by those who have already brought a project to a working state with vibe coding and plan to show it to real users or clients, not just on their own computer. While the project lives as a draft for personal tests, rolling out the whole chain of checks is excessive.

These tools don't replace a full code review with a person on a development team. For an expert's small project it's a reasonable minimum. For a serious service with real money inside, you need a check by a live security specialist, and the tools are only the first filter.

Bottom line

An agent that wrote code won't tell you on its own what it forgot to check. The built-in /code-review and /security-review in Claude Code, and the open gitleaks, Codex Security, fail2ban, and beszel, cover different points: logic, vulnerabilities, leaks, the server after launch. None of them requires you to write code yourself.

I write about tools and setups for vibe coding without an in-house developer in the channel «Растём с ИИ» ("Growing with AI"). A breakdown of a related topic: why an AI site looks cheap and how to fix it.

If you need to go through a specific project and its weak spots in person, you can start with a free consultation.