AI RNG: Practical Systems That Ship
Security review is easiest when nothing interesting is happening. Most pull requests look harmless. A handler gets refactored, a new endpoint appears, a dependency is bumped, a feature flag is added. Then the incident happens later, and you realize the vulnerable behavior was introduced in a few quiet lines that no one read with the right mental model.
Flagship Router PickQuad-Band WiFi 7 Gaming RouterASUS ROG Rapture GT-BE98 PRO Quad-Band WiFi 7 Gaming Router
ASUS ROG Rapture GT-BE98 PRO Quad-Band WiFi 7 Gaming Router
A flagship gaming router angle for pages about latency, wired priority, and high-end home networking for gaming setups.
- Quad-band WiFi 7
- 320MHz channel support
- Dual 10G ports
- Quad 2.5G ports
- Game acceleration features
Why it stands out
- Very strong wired and wireless spec sheet
- Premium port selection
- Useful for enthusiast gaming networks
Things to know
- Expensive
- Overkill for simpler home networks
A good PR security review is not a vibe check. It is a systematic scan for new trust boundaries, new data flows, and new ways an attacker could use normal features in abnormal ways. AI can help you move faster through diffs, trace data paths, and suggest test cases, but only if you keep the review anchored to reality: what inputs can be controlled, what privileges exist, and what assets matter.
What changes make a PR security-relevant
Security issues are rarely labeled “security.” They look like ordinary work. These are the changes that deserve extra attention:
- New endpoints, message handlers, or background jobs.
- Changes to authentication, authorization, sessions, tokens, cookies, or CORS.
- Anything that takes user input and touches a database, shell, templating system, file system, or network.
- Dependency upgrades, new packages, or new build steps.
- Changes to logging, error messages, metrics, or tracing.
- Configuration or infrastructure changes that alter exposure: ports, buckets, CDN rules, headers, or permissions.
A practical way to start is to scan the diff and answer a simple question: did this PR change who can do what with which data?
Build a threat picture in two minutes
You do not need a full threat model to catch most issues. You need a quick picture of the system slice that changed.
- Asset: what would hurt if it leaked or was modified.
- Actor: who can send inputs here, including anonymous users, partners, internal services, and background jobs.
- Boundary: where the code crosses from “untrusted” to “trusted.”
- Effect: what the code can cause: data writes, money movement, access changes, remote calls, file writes.
AI can help you draft this picture if you give it the diff and a short description of the service. The key is to keep the output concrete: specific inputs, specific boundaries, specific effects.
A PR security checklist that maps to real failure modes
This table keeps review focused on the ways vulnerabilities actually slip in.
| Risk area | What to look for in the diff | A fast “proof” to request |
|---|---|---|
| Input handling | raw strings passed into SQL, shell, templating, or regex | a test that rejects dangerous inputs and a safe API call path |
| Authorization | new code paths that skip permission checks | an integration test that a low-privilege user cannot access the action |
| Authentication | session handling, token validation, cookie flags | tests for invalid/expired tokens and correct cookie attributes |
| Sensitive data | secrets in logs, responses, or metrics | a redaction policy and a sample log line showing it works |
| SSRF / outbound calls | URLs built from inputs, internal network access | allowlist validation and a test that blocks internal IP ranges |
| File system | path joins, uploads, downloads, temp files | path normalization and tests for traversal attempts |
| Deserialization | parsing objects from untrusted sources | strict schema validation and a reject-by-default posture |
| Dependency changes | new packages, major version bumps | a quick risk summary, lockfile diff review, and a pinned upgrade note |
| Error behavior | detailed stack traces or internal IDs in responses | consistent error mapping with no sensitive leakage |
| Rate limits / abuse | new endpoints without throttling or cost control | a basic rate limit and request size caps at the boundary |
This checklist is not meant to slow you down. It is meant to stop you from shipping one silent boundary change that later becomes a breach.
Using AI as a reviewer without giving up control
AI is most helpful when you ask it to do structured work that a human would do slowly.
Trace input to effect
Give AI the diff and ask it to list paths where untrusted input reaches a sensitive sink. Typical sinks include:
- database writes and query builders
- shell commands and process execution
- file path operations and uploads
- templating and HTML generation
- outbound HTTP calls and URL building
- dynamic imports, reflection, or deserialization
When AI proposes a path, you confirm it in the code. The goal is not to believe the model. The goal is to accelerate your ability to see the path.
Identify missing checks
A common PR pattern is a new code path that mirrors an old one but misses the important guard. AI can spot this quickly if you ask for it explicitly:
- Which existing endpoints perform permission checks that this new endpoint does not?
- Which validations exist on similar fields elsewhere but are missing here?
- Does this code accept identifiers and then fetch objects without verifying ownership?
Propose security regression tests
A security fix without a test is a hope. A security issue can return quietly the next time someone refactors. AI can help generate the first pass of a regression test if you provide the contract:
- who should be allowed
- who should be denied
- what input should be rejected
- what the error should look like
You still review the test, because tests can encode the wrong contract as easily as code.
Patterns to watch that cause real incidents
Authorization bypass through “helper” paths
Many bypasses happen when code introduces a shortcut: a background job, an internal endpoint, an admin tool, or a “debug” feature. These paths often run with higher privilege. If they accept user-controlled identifiers or payloads, they can become the easiest attack surface.
A good review habit is to search the diff for object lookups by ID and ask: where do we verify that the caller is allowed to act on this object?
Data leaks through logs and errors
Logs are a common leak vector because they feel internal. But logs often end up in third-party systems, dashboards, tickets, and shared channels. The safest posture is:
- log identifiers, not raw content
- redact secrets by default
- avoid logging tokens, passwords, API keys, or full request bodies
- keep error responses user-safe while preserving diagnostic detail in internal logs
If the PR changes logging, treat it as part of the security surface.
Dependency upgrades that add new exposure
A dependency bump can introduce behavior changes: different defaults, new parsers, new request routing, different cookie handling, or altered cryptographic configuration. Review lockfile diffs like you review code. If the change is large, split it out and run targeted tests.
SSRF through “fetch this URL” features
Any feature that fetches a URL or resolves a hostname can be used to hit internal services unless it is explicitly defended. Defense usually requires:
- an allowlist of hosts or domains
- a blocklist of private and link-local IP ranges
- safe redirects handling
- timeouts and body size limits
If the diff includes any new outbound call built from inputs, assume SSRF until proven otherwise.
What “done” looks like for security review
A security-aware PR ends with a small set of concrete artifacts:
- The new boundary is identified: what input is untrusted and where it crosses into sensitive effects.
- The guardrail is visible in code: validation, authorization, or allowlist checks at the boundary.
- The failure mode is safe: errors do not leak sensitive information.
- A regression test exists for the exploit path you prevented.
- Observability supports detection: logs and metrics can identify abuse without exposing secrets.
Security becomes manageable when it is treated as engineering, not fear. AI can speed up the review, but the discipline is yours: make the PR tell the truth about what it changed.
Keep Exploring AI Systems for Engineering Outcomes
AI Code Review Checklist for Risky Changes
https://ai-rng.com/ai-code-review-checklist-for-risky-changes/
AI for Safe Dependency Upgrades
https://ai-rng.com/ai-for-safe-dependency-upgrades/
AI for Documentation That Stays Accurate
https://ai-rng.com/ai-for-documentation-that-stays-accurate/
AI for Error Handling and Retry Design
https://ai-rng.com/ai-for-error-handling-and-retry-design/
AI Debugging Workflow for Real Bugs
https://ai-rng.com/ai-debugging-workflow-for-real-bugs/
Books by Drew Higgins
Christian Living / Encouragement
God’s Promises in the Bible for Difficult Times
A Scripture-based reminder of God’s promises for believers walking through hardship and uncertainty.
