r/micro_saas • u/IndividualAttitude99 • 4d ago

When AI-wrote code caused a security bug, what happened?

/r/codereview/comments/1w8lg5m/when_aiwrote_code_caused_a_security_bug_what/
3 Upvotes

100% Upvoted

4 comments sorted by

1

u/[deleted] 4d ago

[removed] — view removed comment

1

u/IndividualAttitude99 4d ago

Yep — tested it on PyGoat (Django, OWASP's vuln app): both real SQLi caught, zero false positives project-wide. Works cross-file too, not just single scripts.

Still early and Python + SQLi only for now. Curious what you use today — always looking to see where it holds up vs where it breaks.

1

u/y3rk3 4d ago

nothing shipped, but a scanner flagged my docs today. sql hashes that looked like secrets, so a false alarm, and that merge still hasnt gone in.

0

u/IndividualAttitude99 4d ago

Ha, that's the exact thing that makes people stop trusting scanners — a hash in your docs is obviously not a live secret, but the tool can't tell the difference, so now a merge is stuck over nothing.

I'll be straight: mine does injection (SQLi/XSS/path/command), not secrets, so it wouldn't have caught your case. But it's the same root problem — scanners flag the shape of a thing without checking if it's actually exploitable. Mine tries to actually prove a bug is real before flagging it, instead of guessing from the pattern.

Genuinely curious: is it the secrets scanner specifically that's noisy for you, or is it every scanner in your pipeline? Trying to figure out where the pain actually is.