Is code written by AI safe? An honest look at websites built with AI
What research says about AI-generated code, where the real risks are and why a website’s security is determined not by AI but by the person responsible for the result.
Contents
“The website was made with AI? Won’t it get hacked? Won’t client data leak?” I hear these questions regularly, and they’re perfectly fair. AI is often described as a magic button — and just as often as a threat. In this article, I’ll look honestly, with links to research, at whether code written by AI is safe, where the real risks are and how I deal with them on every website.
Where the fear of AI code comes from
The fear has grounds, and it would be dishonest to hide that. Research shows that if you blindly copy what an AI produces, vulnerabilities really do happen.
- In the Veracode 2025 report, more than 100 language models completed 80 tasks where code could be written securely or insecurely. In 45% of cases, the models chose the insecure option.
- In the Stanford University study “Do Users Write More Insecure Code with AI Assistants?”, participants with an AI assistant wrote less secure code — and at the same time were more likely to believe their code was secure.
- According to the Stack Overflow 2025 survey, 84% of developers use or plan to use AI, but only 33% trust the accuracy of its answers, and 66% complain about solutions that are “almost right, but not quite”.
The problem isn’t that the code was written by AI. The problem is that nobody checked it.
Note the conclusion of the Stanford researchers themselves: participants who trusted the AI less and engaged more carefully with its answers wrote code with fewer vulnerabilities. In other words, the risk comes not from the tool but from the lack of control.
How large companies work with AI
AI code has long stopped being an experiment. Back in October 2024, Alphabet CEO Sundar Pichai said that more than a quarter of new code at Google is generated by AI. But the key part of the quote is that it is “then reviewed and accepted by engineers”.
That’s how professional development works: AI speeds up routine work, and a person makes decisions, checks and takes responsibility. That’s how I work too.
AI without control vs AI + a responsible developer
How I handle the risks on every website
1. I’m responsible for the code
The AI doesn’t publish anything itself. I review every screen, check the logic and test the website before launch. For you, it’s not “a website from an AI” but a website from a specific person who is responsible for it.
2. Access and keys are never in the page code
One of the most common mistakes with uncontrolled generation is secret service keys right in the code that any visitor can see. In my projects, keys are stored separately on the server and never reach the browser.
3. The form is protected against bots and has a submission limit
Spam enquiries aren’t just an inconvenience — they’re also a way to overload a website or clutter your database. So the form filters out bots and limits the number of submissions, and you only get real enquiries.
4. Enquiries are stored in a private database
Your clients’ names and phone numbers are personal data. They’re stored in a private database that only you can access.
5 questions to ask any developer
Whoever you work with, these questions will help you understand whether the website will be secure:
- Who reviews the code before publishing, and who is responsible if something goes wrong?
- Where are the keys and access to services stored — do they end up in the page code?
- How is the form protected against bots and spam?
- Where are enquiries stored, and who has access to them?
- Who are the domain, hosting and subscriptions registered to — and will I get all the access?
If you get confident and specific answers to these questions, that’s a good sign — whether or not the developer uses AI.
Are the website and code mine? Can I move to another developer?
Another fear: “I’ll be tied to one contractor.” That doesn’t happen in my work. The website is entirely yours. Subscriptions are registered to you, and the access is yours too — you decide who to give it to. There’s no lock-in: if you ever want to work with another developer, you simply hand them the access.
A client should stay with me because it’s convenient and worthwhile, not because they can’t leave.
I’m not into IT or AI. Will I be able to manage the website?
Yes. A user-friendly CMS lets you manage the content: you change texts and images and add materials without touching the code. You don’t need to know anything about AI or programming — it works like an ordinary text editor.
Before launch, I’ll show you how everything works, record a video guide using your own website and help you if you have any questions.
Why use AI in development at all
If human control is what matters most, what does AI add? The answer is speed without losing quality. Routine work that used to take days, AI does in hours, and the time saved goes into what really affects the result:
- a well-thought-out structure and copy that sells;
- a custom design instead of a template;
- review, testing and loading speed;
- an SEO foundation so the website can be found on Google.
For you, this means shorter timelines and a fair price with no compromises on security. More about prices on the pricing page.
Conclusion
AI code is neither safe nor unsafe in itself — it all depends on who reviews it. Research shows the risks of uncontrolled generation, and that’s exactly why I don’t publish anything without review: I’m responsible for the code, keep keys out of the pages, protect the form against bots and store enquiries in a private database. The website and all access are yours, and you can manage it without technical knowledge.
