Who should review code written by AI before I launch?

Matt Turley, Continuum. Updated November 5, 2026.

What a good reviewer looks at, what to ask for in writing, and the red flags to refuse.

The short answer

Who should review code written by AI before I launch?

A senior engineer with production experience in your stack who did not write the code and does not profit from selling you the fix. They should read the database rules, sign-in, payments and hosting, and give you a written ranked list. The AI tool that wrote the code is a poor reviewer of itself.

What a good reviewer looks at

Who can read and change each table, tested with real requests and not only by reading rules.
Sign-in, sessions and the admin routes nobody thought to protect.
The payment path from checkout to saved order, including repeats and failures.
Where secrets live, and whether any reached the browser or the repository.
Hosting, backups, error reporting, and whether you could recover from a bad day.

What to ask for in writing

A list in plain English ranking each finding by what it risks, the fix for each, and a way to confirm each is closed. You should be able to hand it to any developer and have them start the same day. Ask what was not reviewed too, because a review that does not say its limits is hiding them.

Why not ask the AI tool to review itself

An AI tool will happily review its own work and find a few things. It tends to share the blind spots that produced the code, and it does not know what your business is supposed to allow. Use it as a first pass, then have a person who understands production check the parts that cost you customers or money.

Independence matters too. A reviewer who is paid only if you hire them to repair may find more than exists. Our own Ship Check is a flat $299 for the written read, and you can take that document to anyone.

Red flags in a reviewer

A clean bill of health from an automated scan alone.
A fix quoted before anyone has read the code.
No written output, only a call.
Pressure to give them your own logins instead of a member invite.

Want one concrete finding on your own app?

Paste your live app URL and your email. A short automated check runs three public-security spot-checks and sends back one specific finding and what to do about it. It is free, and it is a preview, never a clean bill of health.

Run the free is-it-safe-to-ship check. Or book a call and talk it through.

Book a call →See all services and prices →

FAQ

Straight answers

Can a freelancer from a marketplace do this?

Some can. Judge them on whether they can show reviews of production apps in your stack and agree to a written, ranked output. A cheap rate with no written result is the usual disappointment.

How much code review does a small app need?

Focus on the parts that handle money, sign-in and other people’s data. A full line-by-line read is rarely needed for a small app; a careful read of those parts is.

Should the original builder fix what the review finds?

Often they can, and it is quicker. Having an independent reader confirm the fix keeps everyone honest, especially when the same tool or person made the original mistake.

Does a review need access to my live data?

No. A reviewer needs to read the code, the database rules and the hosting setup, and can test with accounts they create. Be wary of anyone asking for a dump of real customer data.

Keep reading

Run the free is-it-safe-to-ship checkFree. One finding on your own app.How to evaluate code quality if you are not technicalHow to tell whether the work is good without learning to code.Ship CheckA human read of your codebase and an honest verdict.Who actually fixes a stuck AI-built app?Marketplaces, agencies and a fixed-price partner, side by side.My coding agent says I need a human developerWhat to hand over when the AI tool has run out of road.What does a security review of an AI-built app cost?Scan, written read, or review plus fixes.How to secure a vibe-coded appThe order to work in before you tell anyone it exists.

Sources

1. Continuum pricing, Continuum: Used for every Continuum price on the page. The prices are read from the same list that renders /pricing.
2. The free launch checklist for AI-built apps, Continuum: Used for the key-handling and row level security points, each of which links to the vendor documentation on that page.