IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Review AI-written code
Priya's AI script runs fine. Zara checks it and finds a package nobody knows. Your goal: check that every name in AI code is real.
🧪 Interactive lab — enable JavaScript to play with this one.
- AI code looks finished. Its mistakes look right, too.
- Ask 3 questions. Does it do only what you asked? Can you explain every line? Is every name real?
- Keep each change small. Read the tests first.
- You approve it, so you own it.
Is the package real?
Your project uses code other people wrote: its dependencies. They come from a public library of code, a package registry, like PyPI or npm.
An AI can make up a package name. It often makes up the same name again and again. Picture a courier sent to a shop address that does not exist. A thief rents that empty shop and waits for parcels. Attackers do the same with the name. This is slopsquatting.
Check before you install
A package can run an install script while it installs. So the risk starts at install. Check the registry page first. Warning signs:
- The name is one letter off a famous one.
- It is days old, with one version.
- It links to no source code.
- Its maintainer has no other packages.
- It runs a script when you install it.
Keep each change small
A change should do one job. Google's public review guide says about 100 lines is usually fine. 1,000 lines is usually too big. Keep renames in their own commits.
Read in order of risk. Tests and settings come first, then package files. Then read security code, then logic. Style comes last.
Now split a big change into small ones.
🧪 Interactive lab — enable JavaScript to play with this one.
Go deeper: made-up packages
A 2025 study at USENIX Security tested 16 models on Python and JavaScript code. At least 5.2% of packages from commercial models did not exist. For open-source models, it was 21.7%. They ran 500 of the prompts 10 more times. 43% of the made-up names came back every time. So an attacker can plan for a mistake that repeats.
An older trick is typosquatting: a name one letter away from a popular package. In 2019, PyPI removed jeIlyfish, with a capital I in place of an l. It tried to steal keys. Slopsquatting aims the same trick at AI mistakes.
In 2024, researcher Bar Lanyado registered huggingface-cli, a name models kept making up. His empty package got over 30,000 downloads in three months.
Go deeper: package checks
The name you install and the name you use in code can differ. You install PyYAML, but you write import yaml. Look-alike names use that gap. So check the project's own docs.
A lockfile, like package-lock.json or uv.lock, saves the exact versions you checked. Then tomorrow's install matches today's.
Scanners like pip-audit, npm audit and OSV-Scanner flag known problems. But a package made yesterday may not be reported yet. So your own look-up comes first.
Do you need the package at all? Don't let an agent add packages on its own. Make it a rule: ask before you install anything new (Permissions, sandboxes and secrets).
Go deeper: more AI mistakes
| Looks like (Python) | What is wrong | Do this |
|---|---|---|
json.parse(body) | Made up. It is a JavaScript habit. | Use json.loads |
yaml.load(f) | Old. It fails since PyYAML 6.0. | Use yaml.safe_load(f) |
datetime.utcnow() | Old. Python 3.12 warns about it. | Use datetime.now(timezone.utc) |
except Exception: pass | Hides every error | Handle the error you expect |
f"… WHERE email = '{email}'" | Unsafe SQL | Use ? placeholders |
| A key pasted in the code | Anyone who reads the code gets it | Load secrets from the environment |
hashlib.md5(password.encode()) | Too fast for passwords | Use a slow password hash |
verify=False | Turns off certificate checks | Keep TLS checks on |
AI also writes too much code, or adds a helper the project already has. Ask for the simplest version.
Go deeper: how a change joins the main code
On a team, a change takes 4 steps:
- Branch. You or the agent work on a branch, a separate line of work.
- Pull request. You ask to add it to the main code. The pull request shows the diff, and the tests run.
- Review. A teammate reads it and leaves comments. You fix them.
- Merge. Once approved, it merges: it joins the main code.
Go deeper: AI reviewers
AI can review code, too. As of October 2026, examples include GitHub Copilot code review, Cursor's Bugbot, CodeRabbit and Claude Code. A fresh session, or a different model, is not tied to the first answer.
But they give false alarms. They can miss business rules nobody told them about. So use them as a second opinion, not the final approval.
When the change merges, your name is on it. "The AI wrote it" is not an answer. If you can't explain a line, don't approve it.
Don't ask the AI that wrote it if a package is real. It will usually say yes. Check the registry yourself.
Ask an AI for a script using "the best libraries". Before you install, look up each package on pypi.org. How old is it?