# AI-generated code smells

Use these as test hypotheses when the implementation was AI-generated or the author is unknown. Require code or runtime evidence before prioritizing them.

- Missing null, absent, empty string/list/object, zero, false, NaN, unknown enum, and deleted-reference handling.
- Off-by-one boundaries, wrong loop termination, infinite/retry loops, recursion without depth limits, and pagination that skips or repeats.
- Regexes that are too permissive, too strict, unanchored, catastrophically expensive, ASCII-only, or inconsistent between client/server.
- Hard-coded admin credentials, example passwords, bypass users, API keys, tenant IDs, ports, URLs, dates, feature flags, or “temporary” allowlists.
- Client-only validation/authorization, hidden controls treated as security, predictable IDs, and missing tenant/owner filters.
- Happy-path-only async code: ignored promise errors, swallowed exceptions, optimistic success before commit, missing cancellation/cleanup, and timeout-after-commit duplication.
- Non-idempotent retries, duplicate event/webhook handling, stale closure/state, last-write-wins data loss, and check-then-act races.
- Silent truncation/coercion, float money, locale/time-zone confusion, unsafe date parsing, and mismatched serialization.
- Unsafe rendering, `innerHTML`, command/SQL/template/path construction, open redirects, SSRF, CORS/CSP mistakes, and secrets in URLs/logs.
- CSS/layout generated for one viewport: fixed sizes, overflow, z-index collisions, invisible focus, hover-only actions, low contrast, motion, or theme mismatch.
- Accessibility omissions: unlabeled controls, wrong role/state, keyboard traps, focus loss, error association, live-region noise, and inaccessible custom widgets.
- Resource leaks: orphan processes, sockets, timers, workers, object URLs, file handles, temp files, subscriptions, and event listeners.
- Stubs that look complete: placeholder success, mock data on production paths, no-op error branches, broad catches, TODO behavior, or fabricated telemetry.
- AI-specific mistakes: prompt injection trust, cross-tenant retrieval, unsupported claims, fragile output parsing, unsafe tool scopes, missing confirmation, nondeterministic single-run assertions, and no fallback/abstention.

For each observed smell, link the source location and create the smallest runtime test that can prove or disprove the risk.
