How to Safely Review an AI-Built Repo Before Going Public

Developers using AI coding agents like Claude Code, Cursor, or Codex often prompt the agent to 'review the repo before making it public,' but such vague instructions can yield inconsistent and risky results. A reliable pre-release review must be explicit and strictly read-only, covering the current file tree, Git history, and existing release artifacts separately. Beyond scanning for credentials and API keys, reviewers should also check for privacy residue such as local file paths, internal hostnames, and private project codenames that standard secret scanners typically miss. Git history deserves its own dedicated pass, since secrets deleted from the working tree can still persist in every clone until history is rewritten. The process should conclude by logging any checks that were skipped or could not be verified, keeping the final publish decision firmly with the developer.