A municipal secure-coding workshop discusses AI pair-programming on civic web apps. Which dual-use insight best prepares developers and testers?
Select an answer to reveal the explanation.
Short Explanation
Same AI that drafts your form handler can also sprinkle injection sinks—and then help you spot them on review day. Popular models are not holy water. Humans still own the merge button.
Full Explanation
AI pair-programming on civic web apps is dual-use: assistants can accidentally introduce SQL or command-injection sinks in generated handlers, and the same class of tools can help reviewers spot dangerous patterns. The correct insight is that human review remains mandatory either way—developers and testers both own injection risk when AI touches the codebase. Popularity of a model does not equal absence of sinks, and municipal apps that handle permits, benefits, or resident data cannot treat autocomplete as a security control.
Claiming AI-generated code is automatically free of SQL and command injection is false and dangerous for merge policies. Saying only testers need to worry while developers using AI need no review splits responsibility incorrectly; prevention at coding time matters as much as detection in purple-team windows. Asserting that a popular model cannot produce injection sinks by definition confuses brand familiarity with secure coding guarantees.
Exam caveat: dual-use workshop items reward 'AI can introduce and help find sinks; humans still review,' not automatic safety claims. Operational check: require human code review for AI-assisted civic web changes, scan for injection sinks in generated SQL/OS call paths, add regression tests for parameterized queries, and treat model popularity as irrelevant to merge approval.