Maddy Zhang, a senior software engineer formerly at Google, gives an eight-rule checklist for shipping AI-generated code. About 11 minutes on her channel.

Understand and reuse the code

  • Explain every line before merging. Review an AI-generated change with the same care as a teammate’s pull request.
  • Zhang calls unchecked output verification debt: code arrives faster than people can understand it, leaving the review bill for later.
  • Search before adding a helper. Find existing parsers, retry logic and formatters, then put them in the agent’s context.

Preserve failures and distrust inputs

  • Handle errors meaningfully. Retry, use a valid fallback, or add context and rethrow.
  • Returning an empty payment-method list during a service outage falsely tells customers that their saved cards disappeared.
  • Validate at the boundary. Track where input comes from and where it ends up, including data from internal services.
  • Encode output and use parameterized database queries, which keep input separate from executable query text.
  • A username containing newline characters can forge log entries when inserted directly into a log message.

Prove the fix and contain the damage

  • Reproduce the bug first. Write a failing test, apply the fix, and watch that same test pass.
  • Keep the test as a permanent check against the bug returning.
  • Limit the blast radius. Use feature flags, which let you disable a change without another deployment.
  • Zhang suggests staged releases to 1%, 10%, 50%, then all traffic, with small changes that people can review.
  • Give coding agents tightly scoped permissions and keep standing production-write access out of their default setup.

Preserve intent and inspect dependencies

  • Write down why. Explain unusual timeouts, legacy endpoints and scheduling decisions so the next person or agent preserves their purpose.
  • Put reasoning in short comments, decision records and commit messages.
  • Check every package. Verify its registry entry, maintainers, release history and real downstream users before installation.
  • AI-invented package names create an opening for attackers to publish malicious packages under those names, a tactic called slopsquatting.
  • Commit dependency lockfiles and disable package installation scripts where practical.

Caveat: Zhang cites external surveys and security studies, but the video does not establish that these habits distinguish a measured “top 1%.” It includes a HubSpot sponsorship.

“Every line you merge is code you’re now responsible for, no matter who or what wrote it.” — Maddy Zhang, 00:53