AI can write code that works. Making sure it survives production is still your job.
Here’s the checklist I use when reviewing AI-generated code:
- Is there a database call inside a loop?
- Does each query have the right indexes for its filters and sorting?
- Did it add indexes on columns nobody queries? Every index adds write overhead; faster reads aren’t free.
- Is there an external HTTP call inside a transaction?
- Does it catch an exception and quietly continue? That’s how bugs reach production without leaving useful logs.
- Does it retry an operation that isn’t safe to run twice? Retried writes need idempotency or they can create duplicates.
- Does it scan an entire cache or table to find one item? Fine with 100 rows; painful with a million.
- What happens at ten times the data and ten times the traffic?
- Are there migration or database changes? Check them against the actual queries and execution plans.
- Does the code follow the project’s naming conventions?
AI-generated code is often functionally correct. The assumptions around scale, failure, retries, and data are where things usually break.
Review it like you’d review a junior engineer’s pull request: the code may be right, but the assumptions still need scrutiny.