What security checks would you want before shipping AI-generated code?

Hey, I'm Dean, the developer behind Quick Scan First.

I built this after noticing a pattern: AI-assisted code tends to handle the happy path well but quietly misses things like exposed API keys, open database rules, missing auth checks, and payment/webhook edge cases — the kind of mistakes that don't show up until a real user (or attacker) finds them.

Right now it checks for exposed secrets, open databases, missing authentication, unsafe permissions, payment/webhook mistakes, and vulnerable dependencies, then opens a reviewed pull request with the fix.

Genuinely curious: what else would you want a tool like this to catch before you ship? Any close calls or bugs you've had slip through in AI-generated code that you wish something had flagged earlier?