This one stung a little because I'd been feeling pretty good about the code working.
Acknowledge that AI-generated code is a starting point, not a finished product. Walk through a systematic review process covering correctness, edge cases, security, performance, and maintainability, and emphasize that you would never ship code you don't fully understand.
Pro tip: Frame your answer around risk mitigation: prioritize fixes by impact (e.g., security > correctness > performance > style) and mention that you'd add tests to lock in behavior before refactoring.
Read through the code line by line to ensure you understand what it does and why. Run it against additional test cases, including edge cases and invalid inputs, to uncover hidden bugs.
Look for common vulnerabilities such as injection flaws, improper input validation, and insecure data handling. Ensure sensitive data is protected and access controls are in place.
Analyze time and space complexity, and identify potential bottlenecks. Consider how the code behaves under load and whether it meets the system's performance requirements.
Refactor for clarity, consistent naming, and modularity. Add comments where necessary and ensure the code adheres to team style guides and best practices.
Write unit, integration, and edge-case tests to verify correctness and prevent regressions. Update or create documentation to explain the code's purpose and usage.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.