A security report can feel like a wall if you didn't write the code. What the research says about AI fixing code, and the habit that makes it work.
Part 1 of a short series on fixing AI-built apps with AI, without writing code yourself.
The scan finishes. The report says your app has problems. And then the thought arrives:
“I didn’t write this code. How am I supposed to fix it?”
It’s a strange feeling. A few weeks ago an AI turned your idea into a working app in an afternoon. Now a list of warnings makes it feel like the app belongs to someone else.
I’ve had that feeling. Here’s what changed my mind, and what the research actually says.
AI builders do make security mistakes. That’s not an opinion.
In 2025, the security company Veracode gave more than 100 AI models the same 80 coding tasks. Each task had a safe way and an unsafe way to write the code. The AI chose the unsafe way 45% of the time. Bigger, newer models weren’t significantly better. (Veracode)
And it’s not just beginners who find AI tricky. In Stack Overflow’s 2025 survey of more than 49,000 developers, 84% use or plan to use AI tools. But more of them distrust its accuracy (46%) than trust it (33%). Their biggest frustration, named by 66%: answers that are “almost right, but not quite.” (Stack Overflow Developer Survey 2025)
So if AI-written code makes you nervous, you’re in good company. Professional developers feel it too.
Here’s what surprised me. When AI is pointed at a specific, known problem, the results are strong.
None of those numbers mean “paste the prompt and walk away.”
Look at them again. GitHub’s figures come from GitHub itself, and a developer reviewed every fix before using it. DARPA’s problems were planted for a contest, and even the best systems missed some. Google’s AI fixed 15%, which means it didn’t fix 85%, and an engineer still checked the ones it did.
In every one of those success stories, the AI suggested the fix and something else checked it.
I learned the same thing the hard way. Last week I asked an AI builder to fix a problem in one of my apps. It gave me a “safe” fix that would quietly have stopped “select all” working for more than 100 documents. Nobody would have noticed until a real user saw “Failed to save”. I only caught it because I asked one more question before publishing. (I wrote about it here.)
That’s the “almost right, but not quite” problem from the survey, in real life.
You don’t need to learn to write code to fix your app with AI.
You need to learn to check.
Checking isn’t a programming skill. It’s a habit, made of a few questions you ask at the right moments. Developers ask them almost without thinking. Nobody tells the rest of us what they are.
That’s what this series is about, one part a week:
Verilay is one way to do the checking: it scans your app, explains problems in plain English, and gives you a fix prompt to paste into your builder. After you fix something, you can scan again and compare the two reports, so you’re not just taking the builder’s word for it.
It’s an AI check, not a professional security audit, and I’ll keep saying so. But it means you’re never fixing in the dark.
Have you ever had an AI builder say “fixed” when it wasn’t? Or a fix that broke something else? Email me at [email protected]. Your stories will shape the next parts.
And if a security report has ever made you feel like your own app belongs to someone else: you built it with AI. You can fix it with AI too. You just need to check its work.
One short email a month: what’s new at Verilay, one thing to check in your AI-built app (with a ready-to-paste prompt), and the AI security news worth knowing. No spam, and you can unsubscribe from any issue.