Most of the code written this year was not typed by a person. It was generated by Claude Code, Cursor, Codex, Copilot or something like them, then skimmed, then shipped.
And the assistant does what assistants do. It copies the patterns it has seen most. Those patterns were written for tutorials, not for production. The API key goes in the file. The endpoint has no auth because the example had none. The SQL is a template string. The error response includes the stack trace because that was helpful in the example. The cookie is in localStorage because that was easier to demo.
None of this is a model being dumb. It is a model being faithful to a corpus that was never meant to be deployed.
Teams try to fix it afterwards with scanners and audits. The scanner finds the SQL injection after it was written. Straightedge SI is the thing that happens before. A set of rules the assistant reads first, so the default becomes the secure default.
Prevention is cheaper than detection. It also works on the code you did not get around to scanning.
