Copilot and Cursor do not leave a flag. They leave a repo.

The merge already happened. Copilot completed the function. Cursor applied the patch. Claude Code ran the command. CI is green. The pull request has two approvals, both from people who also use the same tools. Nobody left a comment that says “AI wrote this,” because the tools do not leave a flag. They leave a repository.

I am not writing a ranking of coding assistants, and I am not writing another explainer of what an audit engagement includes — we already published what an AI code audit covers and which SKU to buy first. This is the other half of that conversation: what those tools actually leave in a production repo, and why a point-in-time senior review is the first buy when a questionnaire, a diligence room, or an incident review is already on the calendar. The commercial version is an AI code audit.

The residue is ordinary-looking code

Assistants are good at looking finished. That is the product. A generated authorization check reads like an authorization check. A generated test file has asserts and fixtures. A generated README claims the service encrypts data at rest because the prompt mentioned encryption. None of that is a smoking gun in git blame. It is code that compiles, often code that demos, and sometimes code that is wrong in a way only a person who knows your system will see.

I will not invent a client story or a fake findings quote. The patterns are public and boring, which is why they survive review. Hallucinated package names that resolve to something else, or to nothing, until a lockfile pins a surprise. Snippets that carry a license the prompt did not mention. Secrets that started in .env.example and became a real key because the assistant “completed” the file. An identity check that never looks at tenant. A second cache or queue that is now a second source of truth. Error handlers that swallow the failure so the happy-path test stays green. Comments that describe a BAA, a retention rule, or a least-privilege story the function does not enforce.

Scanners catch some of the secrets and some of the known CVEs. They do not know whether that extra Redis is on your roadmap. They do not know your BAA. They do not know that the “admin” role in the generated middleware is not the admin role in the product. A green badge is hygiene. It is not a findings trail.

What actually lands in main

When I talk to engineering leads who already shipped a year of Copilot, Cursor, or Claude Code, the repo does not look like a science project. It looks like a normal product that got faster. The interesting parts are the paths nobody re-read because they looked like the paths next to them.

Authz and tenancy show up first. Assistants copy the pattern in the file. If the file checked a user id, the new endpoint checks a user id. If the product needed an org, a workspace, or a plan entitlement, that is a judgment call. Models complete the local pattern. They do not own your threat model.

Dependencies show up second. A helpful import is cheap in a chat and expensive in a lockfile. Unvetted packages and pins nobody would have typed by hand are how a supply-chain question becomes a week of archaeology. Tests show up third: generated asserts prove the function returns what it already returns, and they skip the abuse case the prompt never named. Coverage goes up. The critical path does not get safer. If your argument to a buyer is a coverage number, you are already in the wrong conversation.

Docs survive because they sound finished. A generated security section that says “we log access to PHI” is a sentence, not a control. A buyer who has been through SOC 2 will ask for the log, the retention, and the code path. If those three disagree, the document is the liability.

None of this requires you to ban the tools. We have been shipping software since 2002. Assistants are now part of how software gets written. The failure is treating autocomplete as review, and treating review as a process claim you cannot attach to an email.

Why the PR looked fine

Pull request review was built for a human writing fewer lines, more slowly, with more of the system in their head. Assistants invert the volume. The reviewer is now reading fluent code they did not sketch. That is a different job than catching a typo in a function they pair-programmed an hour ago.

Two other things make the PR look fine. The author and the reviewer often use the same assistant, so both have already seen a plausible version of the change — familiarity is not inspection. And CI rewards the happy path: if the generated test lands in the same PR as the generated code, the loop closes on itself.

Internal review of your own Copilot output is still review. It is not what a buyer wants when they ask who looked, at what seniority, and what they wrote down. “We review everything” is a sentence. A severity-ranked finding with a named engineer is evidence.

Where the remote lives, and whether Claude Code may run unattended, are different questions. We already wrote the Cursor Origin checklist and the auto mode checklist. Mixing “what merged” with “where it is hosted” and “who approved the bash” in one Slack thread is how all three get skipped.

A snapshot is the first buy

If a date is on the calendar — fundraise, customer questionnaire, SOC 2 fieldwork, incident debrief — you need a point-in-time picture of what is already in the repo. You do not need a monthly retainer yet. You do not need a chatbot. You do not need a ranked list of tools. You need written findings you can attach to an email, from a named senior engineer, after read-only access, in days rather than a quarter.

That is what an AI code audit is. Fixed scope. Client code stays in your environment. No third-party model on your source. A live walkthrough of what to fix first. Tool-specific search still has a landing: Copilot & Cursor code audit. If the product was mostly prompted into existence and never had an engineering process, start with vibe coding governance instead — different bar, different SOW.

Buy monthly oversight in the same conversation if you will keep merging assistant output after the date. The snapshot goes stale. That is not a reason to skip the snapshot. Buy governed MCP only if the actual blocker is agents on CRM, EHR, or ERP. An audit of Copilot diffs will not authorize Claude against the system of record. Two questionnaires. Two engagements.

Healthcare and PHI do not change the first SKU. They change the access model. Clinical product and BAA-capable architecture live at Maxiom Labs. Say PHI on the scoping call so nobody pretends a generic SaaS review is a healthcare engagement.

Questions I get this week

Can we just run a scanner and call it the audit?

No. Run the scanner. Keep it in CI. Do not hand the output to a buyer as the review program. Scanners do not judge architecture against your roadmap or map a finding to the control the questionnaire named.

Do we have to stop using Copilot or Cursor?

No. You have to stop pretending last year’s “human in the loop” paragraph describes a repo that merged a year of assistant output without an independent pass.

Is this the same as a pentest?

No. A pentest hits a running system. This is source and design — including the paths a pentest never exercises because the feature is behind a flag or the abuse case is a tenant boundary, not a CVE.

Will you run our repo through an AI reviewer?

No. Client code stays in client environments. Inspection is a named senior engineer. That is the product.

We already review every PR. Why pay for a snapshot?

Because the buyer is not asking whether you have a process. They are asking for evidence of what is in the tree right now, from someone who does not also ship the same diffs. Internal review is necessary. It is not independent.

What if we have no deadline?

Then you can wait, or you can use the free AI Code Risk Checklist tonight and decide whether the gap is real. Most teams who wait do it until a date appears. The date is a worse time to start looking.

If you want the snapshot written as an engineering artifact — not a slide — request an AI code audit or request a scoping call. Thirty minutes is enough to pick a scope, or to hear that we are not the fit.

I write from the seat of a working engineering company, not a tool vendor. More at antoniochagoury.com.