← all checklists

AI-Generated Crypto, Dependency & Config Bugs

69 items · source

Copy as markdown

Filter items

Crypto Bugs

• Review every generated encryption function.
• Review every generated signing function.
• Review every generated hashing function.
• Review every generated token-generation function.
• Review random-number generation.
• Review nonce generation.
• Review IV generation.
• Review key generation.
• Review key storage.
• Review key rotation.
• Review encryption modes.
• Review authentication tags.
• Review password hashing.
• Review salt generation.
• Review key derivation.
• Reject custom cryptographic algorithms.
• Reject "encrypted" identifiers that are not authenticated.
• Reject predictable token generation.
• Reject static IVs.
• Reject hard-coded keys.
• Reject home-grown crypto protocols.
• Prefer platform/library primitives.

Dependency Vulnerabilities

• Review every dependency added by AI.
• Verify the package is actually necessary.
• Verify package name is correct.
• Verify package is not a typosquat.
• Verify package maintainer.
• Verify repository authenticity.
• Verify package popularity/maintenance.
• Check recent releases.
• Check security advisories.
• Check transitive dependencies.
• Review install scripts.
• Review postinstall.
• Review native modules.
• Review package permissions.
• Review network access.
• Review filesystem access.
• Remove duplicate libraries.
• Avoid adding an entire framework for a trivial function.
• Avoid security libraries generated without understanding their configuration.
• Avoid outdated copied snippets.
• Run SCA after every major AI-generated change.

Configuration Bugs

Review every AI-generated:

• .env
• Kubernetes manifest
• Terraform
• Pulumi
• nginx configuration
• CSP
• CORS
• IAM policy
• Apple entitlements
• build settings

Verify AI did not:

• enable public access
• disable TLS
• disable certificate validation
• enable wildcard CORS
• expose secrets
• grant * IAM permissions
• make a bucket public
• disable RLS
• disable security headers
• weaken CSP
• store cloud credentials in CI
• use long-lived cloud credentials unnecessarily
• turn off logging/auditing
• add a permissive firewall rule
• expose a database port
• expose internal administration endpoints