How I audit AI-written code — and the bug that proved why
I build most of my software as an AI-augmented solo developer. I write the spec, I own the architecture, and I drive Claude Code and Cursor through the implementation. But there is one rule I never break: I audit what actually ships, not what the model tells me it produced. Here is the bug that turned that rule into a habit. The symptom that shouldn't exist CoalTrack is an attendance and payroll…
I develop most of my software as an AI-augmented solo developer. I create the specifications, own the architecture, and drive Claude Code and Cursor through the implementation. However, there is one unwavering rule I never violate: I verify the actual product, not the model's output. This rule became a habit due to an instance that proved its importance.
CoalTrack is an attendance and payroll application for coal-mining crews. During closed testing, certain devices failed to connect to the server - there were no error messages, no retry loops, just complete silence. The code appeared correct, the API was functioning, and the same build had worked on my machine previously. To uncover the issue, I stopped analyzing the source code and began examining the actual artifact.
I disassembled the signed app bundle and scrutinized the AndroidManifest.xml that Google Play ultimately receives. The android.permission.INTERNET line was missing.
Why the source code led me astray: In a multi-module Flutter build, the manifest you write is not the same as the one that is shipped. Plugins, build types, and manifest merging all alter the manifest. An upstream change had inadvertently removed the INTERNET permission from the merged result, resulting in the app having no network access upon a fresh installation without cached grants.
On my phone, it worked because the permission had been granted by a previous build and persisted through the upgrade. Reading the source code would never have revealed this issue; inspecting the shipped bundle did so within minutes.
The lesson learned from this incident is that AI-augmented work, when handled responsibly, can significantly speed up development. However, this comes with a heightened responsibility for verification. Conclusively, this means: verify the product, not the intent; inspect the built bundle, the merged manifest, the generated SQL migration - the actual running code; write risky logic twice intentionally; and gate everything with extensive tests.
Currently, over 400 automated tests are run in CI before any signed build. The use of AI to generate code remains safe if more code is also checked. Approach the model's output like a junior engineer - expect it to make mistakes and treat its output accordingly. Ultimately, the fact that AI wrote the code is neither a flaw nor a testament to its quality.
The engineering is still mine, encompassing the specification, the review process, and the decision on what is correct. The productivity gained from AI is undeniable, but so is the responsibility. Audit the AI-written code, not just the optimism.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
