Articles

How software works underneath

Breakdowns of security, reliability and AI-written code, each with the file:line patterns behind it.

See Codeneath Reviews

app-architecture.map3 layers · 6 questions

Screen & bundleQ1 · WorksQ2 · Keys
SettingsForm.tsx · NEXT_PUBLIC_*Optimistic UI lies and privileged keys in browser JS.
Server & webhooksQ2 · AuthQ5 · Failure
projects.ts:17 · stripe/route.ts:29Cookie-only checks, missing orgId gates and replayed events.
Data & modulesQ3 · FastQ4 · ScaleQ6 · Maintain
dashboard/page.tsx:22 · lib/utils.tsN+1 query loops, unbounded tables and tangled files.

All breakdowns

Patterns that AI-written code often gets wrong, each traced to the line and the fix.

It works.Is it safe?

app/actions/projects.ts:17app/api/stripe/route.ts:29app/dashboard/page.tsx:226/6

X-ray code

export async function updateProjectTitle(projectId, title) {
  const session = await getSession();
  if (!session) throw new Error("Unauthorized");
  // Missing ownership check: any signed-in user
  return db.project.update({
    where: { id: projectId },
    data: { title },
  });
}

Code review and hardening · 6 min read

How We Review AI-Built Codebases: Six Questions and File-Line Evidence

Automated scanners flag syntax patterns while missing broken authorization, silent failure paths, and client-trusted state. Here is how a Codeneath Review inspects an application from entry route to database row.

cookies().get('session')where: { userId: input.userId }NEXT_PUBLIC_SERVICE_KEY2/6

X-ray code

const token = cookieStore.get("session_token")?.value;
if (!token) redirect("/login");
// never verified: signature, expiration, revocation
export async function getBillingHistory(requestedUserId) {
  return db.invoice.findMany({
    where: { userId: requestedUserId },
  });
}
NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY=…

Security and vulnerabilities · 7 min read

Authentication Traps Under the Hood of AI-Generated Web Apps

Sign-in screens look finished long before authentication is safe. We break down cookie-presence checks, client-supplied user IDs, unverified webhooks, and token leakage.

Want this check on your code?

A Codeneath Review answers the six questions for your app, with a fix for every finding.

Request a free fit call contact@codeneath.dev