AI coding assistants nail secure login code, but business-logic gaps remain

A developer tested two AI coding assistants by prompting both to write a login endpoint that authenticates users and returns a session token. Contrary to common assumptions, both tools produced secure implementations, using parameterized queries to prevent SQL injection and proper session token handling. One assistant went further by storing only a hashed session token server-side, which the developer noted is a stronger pattern than using JWTs. The experiment was run through AI Code Guard, a PR security scanner the developer is building, and revealed that frontier AI models handle well-known security patterns reliably. However, the developer cautioned that the real risk likely lies in context-specific business-logic authorization, which is harder to catch with standard checks.