AI-generated code should be treated as a proposed implementation. Read the data flow, run it in a controlled environment, and verify behavior with normal, empty, invalid, and unexpected inputs.
Understand the boundaries
Identify every input, output, network request, storage location, dependency, and privileged action. Confirm that secrets remain server-side and user-provided content is handled safely.
Test the behavior you promised
Turn the definition of done into a checklist. Test each item manually or automatically, then inspect the browser console and network panel for failures that the interface may hide.