I ran a security audit on one of my apps. 21 real findings in under an hour, 20 fixed the same day.

This week I ran a security audit on one of my production apps. It found 21 real problems in under an hour. Twenty were fixed the same day. One was deliberately left for a human, and that split is the interesting part.

The audit was AI-assisted but not AI-trusted. The harness swept the codebase against a real security baseline: auth enforcement on every route, tenant isolation, input validation at boundaries, secrets handling, injection surfaces, header configuration. Every candidate finding then had to survive verification before it counted, because a security finding that does not reproduce is noise wearing a siren.

The 21 that survived were unglamorous, which is exactly what real findings look like. Missing authorization checks on endpoints that middleware appeared to cover but did not. Validation gaps where external input reached logic while only half-checked. Configuration that was fine when written and wrong after the infrastructure under it moved. Not one of them was exotic. All of them were exploitable.

Twenty got fixed the same day because the fixes were code: add the check, validate the input, tighten the config, and every fix passed back through the same gates as any other change. This is where the speed genuinely came from. Not from the tooling writing clever code, but from it never getting bored during the sweep and never skipping the twelfth route because the first eleven were fine.

The twenty-first finding needed a human, because it was a credential that required rotation, a real decision with operational consequences that no tool should make alone. The harness flagged it, explained why it stopped, and waited.

That is the honest shape of AI-assisted security work right now: machines are excellent at exhaustive, verified sweeps, and the judgment calls stay human. Teams getting this backwards, trusting generation but skipping the sweep, have it exactly inverted. The sweep is the part that scales.