Plan AZ: AI Coding Security & Testing Checkup — Mandatory Before Shipping
Input validation → secret management → dependency audit → automated tests → review checklist
- Time
- 1-2 hours / delivery
- Cost
- Low
- Difficulty
- Advanced
Best for
Steps
Input validation & injection protection
10-15 minClaude Code + you
List every user input point: URL params, form fields, request bodies, file paths, export filenames. Focus on the three flaws AI code most often ships — XSS (unescaped front-end rendering), SQL injection (string-concatenated queries) and path traversal (user input used to build file paths). Confirm each entry point is validated or escaped, and at minimum rejects invalid input — never rely on client-side validation alone.
💡Ask Claude to trace where every piece of data coming from a user or request ends up, then confirm each entry has allowlist validation or parameterized queries.
Secrets & sensitive information
10-15 mingitleaks / git log + .env
Check that API keys, tokens and passwords aren't hardcoded in code, in git history, or in logs. Models sometimes write sample secrets or env vars straight into source, and once a secret lands in a repo the damage is permanent. Standard practice: inject via .env + environment variables, gitignore the .env file, and scrub anything already committed from history.
💡Scan history with git log -p | grep or gitleaks; once a secret leaks, rotation beats deleting the commit.
Dependency audit
10-20 minnpm audit / Snyk
Run npm audit or a dependency scanner to surface known vulnerabilities and outdated versions. AI-generated dependencies tend to be the latest or whatever the model 'remembers', which may carry known CVEs or be end-of-life. Triage results by severity — fix high/critical first, and when no fix exists, assess the risk or replace the library.
💡Don't blind-install packages — check download counts, maintenance cadence and author reputation; lock exact versions so transitive dependencies can't silently shift.
Automated tests
30-60 minVitest / Jest / Playwright
Write unit tests for critical logic and end-to-end tests for the key business paths. Don't just test the happy path — add edge cases, bad input, insufficient permissions and timeouts. Have the AI generate cases from your code, but manually add the scenarios where 'the user will do the wrong thing'.
💡Write a failing test first (red), then make it pass (green) — it exposes real problems better than back-filling tests after the fact.
Delivery review checklist
15-30 minreview checklist + you
Walk a checklist item by item: input validation, secrets, dependency audit, test coverage, access control, error handling and log redaction. Write the conclusion of every item into the delivery notes — who checked, what was found, what risk remains. This turns the 'checkup' into a traceable delivery artifact instead of a formality.
💡Keep the checklist as a fixed template committed to the repo (e.g. checklist.md) so you reuse it next time and gaps jump out.
Tools involved
Pitfalls to avoid
Only testing the happy path (edges will blow up)
Hardcoding secrets into code/repo (leaks are permanent)
Blind-installing dependencies brings in vulnerabilities (the chain is long)
All green but critical paths untested (green doesn't mean real)
Related Workflows
Plan G: AI Coding Workflow (Requirements to Delivery)
Clarify requirements → technical plan → scaffold → incremental coding → test & debug → review & commit
- Time：
- 1-4 hours / feature
- Cost：
- Medium
- Difficulty：
- Advanced
Plan AX: Context Engineering — Feed the Right Context, Get It Right the First Time
Document project memory → spec first → give enough relevant files → iterative feedback → verify & commit
- Time：
- 1-3 hours / task
- Cost：
- Low
- Difficulty：
- Advanced
Plan AY: From Vibe Prototype to Viable Product — Pre-Launch Polish Checklist
Lock down requirements → make it testable → error handling → performance → maintainability → documentation
- Time：
- 0.5-2 days
- Cost：
- Medium
- Difficulty：
- Advanced