Last Wednesday at 3 AM, I almost handed over 2,000 members' data
A friend asked me to help set up a membership system. I had AI write the login code, copy-pasted it, and shipped it live. The next day, the client got weird verification codes. My back went cold.
This isn't a one-off — "AI writes code → direct copy-paste" is a trap
After digging in, I found the AI-generated code had an authorization flaw — anyone could bypass login and access the database directly. I'm not a developer. I didn't see it. AI didn't warn me either.
My buddy Lao Zhang (his WeChat public account is "Lao Zhang Sells Fruit" / 老张卖水果), who runs his own e-commerce site, had AI add payment to his mini-program last month. Within two days, 800 RMB got swiped. The problem: the AI-generated code didn't validate amounts. Amounts could be set to negative.
Not just in China. I follow a UK-based indie developer Simon Willison, who tracks these crash-and-burn cases on his blog. His compiled list shows: from 2024 to now, public "AI-generated code causing security incidents" on GitHub number in the hundreds. The three most common traps:
1. Authorization checks written wrong or missing (this is what bit me)
2. Using outdated encryption methods (AI still recommends MD5 — long obsolete)
3. Putting keys directly in the code (like taping your house key to the front door)
AI isn't trying to hurt you. The code it learned from training data is just mixed quality. AI doesn't understand "security" — it only understands "looks plausible."
Want to dodge this today? Lowest-cost play
If you don't touch code at all and only use existing tools (like Youzan, Weimob, Notion), you can close this tab — nothing to worry about. But if you've had AI write even one snippet for you, keep reading.
- Cost: $0
- Time: 30 minutes
- Technical barrier: You just need to be willing to read a bit
- First step: Open any recent code AI wrote for you, search for these keywords — "password", "admin", "secret", "api_key". If any of them appear in plain text, stop.
A safer move: take the AI-generated code, copy it into another AI to audit it for you. For example, paste what GPT wrote into Claude and ask: "Does this code have any security risks?" Two AIs cross-checking each other — much smaller chance of missing something. But remember: AI auditing AI ≠ real security. The most reliable option is still paying a tech-savvy friend 200 RMB to review it.
Different play for three types of people
If you're just starting out (0 customers): Using AI to write code is fine, but don't use it anywhere involving login, payment, or data. Only use AI for pages, copy, and static content. Once you have your first paying customer, then consider getting someone to review.
If you have 1-2 clients: Spend 30 minutes today, go through all AI-written code in your projects. Anything you're unsure about, roll back to the version without AI. That's exactly what I did — better to move slower than let the client pay for my mistake.
If you're scaling (5+ people / multiple projects): This can't rely on self-discipline — it needs to be baked into the workflow. The mistake I made before was "one person assuming everything's fine." My suggestion: set a rule — any AI-generated code must be reviewed by a second person before deployment. Even if that person is a part-time developer you hire. 500 RMB buys you a peaceful night's sleep.