The words,defined.

AI-generated code is source code produced by a language model from a natural-language prompt rather than written line by line by a person.

It is usually syntactically valid and often functionally correct for the case described in the prompt. What it cannot know is the cases nobody described: your auth model, your tenancy rules, the state machine two files away.

Vibe codingHallucinationAI origin probability

Vibe coding is building software by describing what you want to an AI assistant and accepting its output largely as written, without reading it line by line.

The term was popularised by Andrej Karpathy in early 2025. It is fast and, for prototypes, entirely reasonable. The risk arrives when a prototype built this way ships to production without anyone having read it.

AI-generated codeCode reviewWhat vibe coding is, and where it breaks

An AI coding assistant is a tool that generates or completes code inside your editor, such as Cursor, GitHub Copilot, or Claude Code.

These are generators. They optimise for producing code that looks right and compiles. Checking whether it is safe to ship is a separate job with a different incentive, which is why an independent review layer is not the same product.

AI-generated codeHow Nexdge compares

A hallucination is output a language model states confidently that is not true: an API that does not exist, a parameter that was never in the signature, a library that was never published.

In code this is unusually dangerous because the output is plausible. A hallucinated package name that an attacker then registers is a real supply-chain attack, sometimes called slopsquatting.

AI-generated codeFalse positive

AI origin probability is an estimate of how likely a given piece of code is to have been machine-generated rather than hand-written.

It is a signal, not a verdict, and it is useful mainly as context: code with a high score deserves a closer look at the assumptions nobody stated in the prompt. Nexdge reports it on every review.

AI-generated code

Prompt injection is an attack where text an AI system reads as data is crafted to be interpreted as instructions instead.

If your application feeds user input, file contents, or web pages into a model, all of it is untrusted. The defence is treating retrieved content as data everywhere in the pipeline, not filtering for phrases that look like commands.

Input validationOWASP Top 10

Code review is the practice of having code examined for defects, security flaws, and maintainability problems before it is merged or deployed.

Traditionally done by another engineer reading a diff. The assumption underneath it is that the author understood what they wrote, which is exactly the assumption AI-generated code breaks.

Automated code reviewPull request reviewHow review works at Nexdge

Automated code review is machine analysis of source code for defects and risks, run without a human reading every line.

It covers ground a person cannot at speed, and it misses what a person catches by knowing the business. The useful question is not automated versus human but which failures each one is actually good at finding.

Code reviewStatic analysisBusiness logic validation

Static analysis, or SAST, examines source code without running it, matching it against rules and known vulnerable patterns.

Fast, deterministic, and excellent at the failures that look the same everywhere. It is structurally blind to anything that depends on intent, because the rule would have to know what the code was supposed to do.

Dynamic analysisLinterBusiness logic validationFalse positive

Dynamic analysis, or DAST, tests a running application from the outside, probing live endpoints for exploitable behaviour.

It finds what actually happens rather than what the source suggests should happen. The trade is that it needs something deployed to test, and it only reaches code paths the probe manages to trigger.

Static analysis

A linter checks code against style and correctness rules, flagging formatting inconsistencies and a narrow set of likely bugs.

ESLint, Ruff, and Clippy are linters. They are essential and they are not security tools: passing lint says a file is tidy and idiomatic, not that its authorisation logic is right.

Static analysisCode review

A pull request review is the check performed on a proposed set of changes before they are merged into the main branch.

It sees a diff, not a system. A change that is correct in isolation and wrong in context is the failure mode a PR review is least equipped to catch, and the one AI-generated code produces most.

Code reviewShift left

A verified rewrite is corrected code that has been re-reviewed after being rewritten, so the fix is checked before it is handed back.

The distinction matters because a rewrite is itself generated code and can introduce its own faults. Returning an unchecked fix moves the problem rather than solving it.

Code reviewAI-generated codeHow to read a report

Severity grading ranks each finding by how much damage it can do and how easily it can be triggered, typically from critical down to low.

Without it a review is a list, and a list of two hundred undifferentiated items gets ignored in full. Grading is what makes a report actionable rather than merely complete.

False positiveCode reviewWhat each grade means

A false positive is a finding a tool reports as a problem that is not, in fact, a problem in this codebase.

The real cost is not the wasted minute, it is the habit. A tool that cries wolf often enough trains its users to skim past the one finding that mattered.

Severity gradingStatic analysis

Shift left means moving quality and security checks earlier in the development process, closer to the moment code is written.

A flaw caught while the author still has the context in their head costs a fraction of the same flaw found in a penetration test six months later.

Pull request reviewCI/CD

Business logic validation checks whether code does what the business actually requires, as opposed to whether it is syntactically and structurally sound.

Applying a discount after tax instead of before is valid code, passes every linter, and is wrong. No pattern-matching tool can catch it, because the rule it violates was never written down anywhere the tool can read. It has to be told what the code is supposed to do.

Static analysisCode reviewBusiness context in a review

SQL injection is an attack where input is crafted so that a database treats it as query syntax rather than as a value.

The cause is almost always string concatenation into a query. Parameterised queries fix it completely. It has been in the OWASP Top 10 since the list existed and AI-generated data layers still reproduce it.

Input validationOWASP Top 10

Cross-site scripting, or XSS, is an attack where an attacker gets their script executed in another user's browser in the context of your site.

It arrives through any path where untrusted input reaches the page unescaped. The consequence is session theft, credential capture, or actions taken as the victim.

Input validationOWASP Top 10

An insecure direct object reference, or IDOR, is a flaw where changing an identifier in a request returns another user's data because the server never checks ownership.

Sequential IDs make it trivial to find. It is the most common form of broken access control, and it is invisible to any tool that does not know who is supposed to be allowed to see what.

Broken access controlBusiness logic validation

Broken access control is any failure to enforce what an authenticated user is permitted to do, allowing them to reach data or actions outside their privileges.

It has ranked first in the OWASP Top 10 since 2021. Authentication asks who you are; authorisation asks what you may do, and it is the second one that gets skipped.

Insecure direct object referenceRow-level securityOWASP Top 10

Hardcoded credentials are API keys, passwords, or tokens written as literal values in source code rather than loaded from the environment at runtime.

Once committed, a secret is in the repository history permanently, and rotating it is the only real remedy. Deleting the line does not undo the exposure.

Input validation

Input validation is checking that data entering a system matches the type, shape, and range the system expects before anything acts on it.

It is the single control that shuts down the largest share of injection classes at once. Validate at the boundary, on the server, and treat anything from a client as hostile regardless of what the client-side check said.

SQL injectionCross-site scriptingPrompt injection

The OWASP Top 10 is a periodically updated list of the ten most critical web application security risks, published by the Open Worldwide Application Security Project.

It is a consensus baseline rather than a standard to certify against, and it is the vocabulary most security conversations and most compliance questionnaires assume.

Broken access controlSQL injectionCross-site scripting

A CVE is a public identifier assigned to one specific, disclosed security vulnerability in a specific product or library.

CVEs describe known flaws in dependencies you pull in. They say nothing about flaws in the code you wrote yourself, which is a different problem needing a different check.

OWASP Top 10

Zero data retention means submitted data is processed in memory and discarded when processing ends, never written to persistent storage.

As a policy it is a promise. As an architecture it is a property, because there is no store to breach and no export to request. The difference matters when you are asked to justify it.

GDPRRow-level securityHow retention works here

Row-level security, or RLS, enforces at the database which rows a given user can read or write, rather than relying on the application to filter correctly.

It moves tenant isolation below the layer where most access-control bugs live. A query that forgets its WHERE clause returns nothing instead of everything.

Broken access controlInsecure direct object reference

A race condition is a bug where the result depends on the relative timing of concurrent operations, so the same code produces different outcomes on different runs.

They pass tests, survive review, and surface under load months later. Payment flows and inventory counts are where they hurt most, because the failure is silent and financial.

IdempotencyBusiness logic validation

An N+1 query is a pattern where fetching a list costs one query, and then one additional query is issued per item in that list.

Invisible with ten test rows, fatal with ten thousand production ones. ORMs produce it by default whenever a relation is accessed inside a loop.

Time complexity

Time complexity describes how an algorithm's running time grows as its input grows, written in big-O notation such as O(n) or O(n squared).

A nested loop over the same collection is O(n squared): fine for a hundred items, an outage at a hundred thousand. Growth rate, not speed on your laptop, is what decides whether something survives scale.

N+1 query

An operation is idempotent when performing it repeatedly has the same effect as performing it once.

It is what makes retries safe. Without it, a network timeout on a payment request leaves you unable to retry without risking a double charge, and unable to not retry without risking a lost one.

Race conditionRate limitingIdempotency keys in the API

Rate limiting caps how many requests a client may make in a given window, rejecting the excess.

It protects against both abuse and accident, and an unlimited endpoint is a denial-of-service vector and a cost-control failure at the same time.

Circuit breakerIdempotency

A circuit breaker stops calling a failing dependency after a threshold of failures, returning an error immediately instead, then retries after a cooldown.

It prevents one slow service from exhausting the connection pool of everything that depends on it, which is the mechanism behind most cascading outages.

Rate limitingError handling

Error handling is the code that decides what happens when an operation fails rather than succeeding.

The two failures worth naming are the swallowed error, where a catch block does nothing and the fault becomes invisible, and the leaked error, where an internal message reaches the user and tells an attacker how the system is built.

Circuit breaker

CI/CD is the practice of automatically building, testing, and deploying code through a pipeline triggered by changes to the repository.

The pipeline is where checks become mandatory rather than optional, because a gate there cannot be skipped by a developer in a hurry.

Shift leftPull request reviewAdding a review to your pipeline

SOC 2 is an auditor-issued report on how an organisation handles customer data, assessed against five trust services criteria including security and confidentiality.

Type I reports on controls at a point in time, Type II on how they operated over a period, usually three to twelve months. It is a report about your controls, not a certificate you pass.

ISO 27001Code governanceSOC 2 and AI-generated code

ISO 27001 is an international standard for information security management systems, against which an organisation can be formally certified.

Where SOC 2 reports on controls, ISO 27001 certifies a management system: the documented process by which you identify risks and decide what to do about them.

SOC 2Code governance

The General Data Protection Regulation is the European Union law governing how personal data of people in the EU may be collected, processed, and stored.

It applies wherever your company is based if those people are your users. Two articles come up constantly in engineering: Article 17, the right to erasure, and Article 22, on decisions made by automated processing.

Zero data retentionCode governanceHow Nexdge handles data

Code governance is the set of rules and evidence that determine what may be merged and deployed, and the record proving those rules were applied.

The question it answers is not whether your code is good but whether you can show how you know. That evidence requirement is what turns review from a habit into a control an auditor can accept.

SOC 2ISO 27001Shift left