Replit's Security Strategy for AI-Generated Code [Whitepaper]

AI-generated code is changing the way software is built, but it also poses new challenges in terms of security. In particular, questions have been raised about whether it is sufficient, from a security standpoint, for AI models to inspect their own outputs.

Replit conducted a comparative study on React applications, examining a hybrid approach that combines AI-only security scanning with static analysis and dependency scanning. The experiment confirmed a non-deterministic characteristic: even functionally identical code produced different security assessment results depending on syntax or prompt composition.

Key findings of the study are as follows:

• Non-deterministic nature of AI-only scanning: The same vulnerability was classified differently depending on variable naming or syntactic variation
• Prompt sensitivity issue: Detection rates increased only when security issues were explicitly mentioned, placing a greater burden of responsibility on the user
• Inability to detect dependency vulnerabilities: Without a continuous vulnerability feed, AI cannot identify version-specific CVEs
• Consistency of static analysis: Rule-based scanners provide deterministic, repeatable detection across all code variations

In conclusion, while LLMs are useful for identifying business logic or intent-level issues, static analysis and dependency scanning must be used in parallel to establish a reliable security baseline.