The "if it works, ship it" trap, and the one habit that actually prevents it
There's a specific moment that happens with almost every project: the agent produces code, it passes your tests, everything's green, and there's a real pull to just move on to the next thing. Totally understandable, the whole appeal of this workflow is speed.
But there's a gap between "this works" and "I understand why this works," and that gap is where the real risk hides. Not because the code is wrong, most of the time it isn't, but because the next time something breaks nearby, you're debugging code you never actually read closely the first time.
during the BC (before ChatGPT) era, this gap barely existed. You wrote it, so you understood it, mostly by necessity. Now understanding is a separate step you have to choose to take, not something that comes free with writing the code yourself.
One habit that closes that gap fast: before merging anything non-trivial, ask the agent to explain its own implementation back to you, line by line, in plain language. Not as a formality, actually read the explanation. Two things tend to happen. Either it confirms your understanding and takes thirty seconds, or it surfaces an assumption you didn't know was baked in, which is usually the more valuable outcome.
This becomes especially important with anything touching auth, state management, or async logic, the categories where "it worked in my test" and "it's actually correct" diverge the most.
Curious what habits others have built for this. Do you have a personal checklist before merging AI-generated code, or a specific type of change you never let through without reading line by line, regardless of how confident the tests looked?
Replies
The sharpest version of this gap I know is Row Level Security, because it fails in a way that keeps every signal green.
You ask the agent for a policy so users only read their own rows. It writes one. It looks right, it reads right, and your tests pass — because you wrote the tests from a single account. The policy filters through a joined membership table and the join is not isolated, so a user who belongs to two organisations satisfies it for both. Nothing goes red. Supabase's own linter stays happy too, because a policy does exist. You find out when your second real customer arrives and sees someone else's data.
That is the exact shape you're describing: not wrong code, unexamined code. And it survives the "ask the agent to explain it back to you" habit, which I otherwise agree with — the agent explains the policy correctly, because the SQL genuinely does what it says. The bug is in the assumption underneath, not the implementation.
The only thing that reliably catches it is testing from a second identity. One extra account, belonging to two tenants, running the same read. That single test is worth more than a full explanation pass, at least for anything touching a data-access boundary.
I got tired of describing this and built a reproduction instead — same test suite, red on one branch, green on the other, npm ci && npm test, about two seconds, no Docker: github.com/cekuu35/supabase-rls-leak-demo
And because people kept asking what else to check before shipping, I put the ten checks I actually run into a free PDF, no strings: cengokurtoglu.gumroad.com/l/nextjs-supabase-10-checks-free