6-point checklist for reviewing AI-generated code changes

The checklist

1. Dependency changes — Did the agent add, remove, or update packages (package.json, requirements.txt, go.mod)? Check necessity, reputation, and lockfile consistency.
2. Auth/payment/security paths — Did the diff touch auth middleware, payment processing, or security-critical code? These need extra-human review.
3. Config and infrastructure — Did .env, config.yaml, Dockerfile, docker-compose, or CI pipeline files change? Verify they match all environments.
4. Source changed without tests — If a source file changed but no test file changed, the change is either untested or the agent wrote code it didn't verify.
5. Secret-like literals — Look for api_key=, token=, password=, or long random strings. Sometimes they're test fixtures. Sometimes they're real credentials.
6. Large or generated-looking diffs — 500+ line diffs or files that look auto-generated get a lower trust score. Review line-by-line or request a clear explanation.

Automate this checklist

The AI Agent Change Risk Audit Kit runs this checklist automatically on every diff — local, no cloud, under 1 second, with CI integration.

See it in action

• Sample risk audit report
• ROI calculator
• Buyer FAQ & objection handler
• Manual review vs risk audit comparison
• Full product page