What in the actual heck?

Made this thing to show how TypeScript strips out types when compiling to JS.

You can step through it and see what gets removed. Pretty simple but figured it might be useful for explaining to people how TS works under the hood.

Got asked to do a security audit on a mid-size Node.js backend. The team had been using Cursor + Claude heavily since last summer. About 60% of the codebase was AI-assisted or fully AI-generated.

The code passed every check. No injection vulnerabilities, no obvious race conditions, decent error handling. Tests covered 78% of branches. On paper, it was fine.

Then I spent a week actually reading it.

Every function did exactly what it was supposed to do. Nothing more. There was no shared understanding of why things were structured the way they were. Comments explained what the code did, not why. Functions that obviously belonged together were scattered across unrelated files because that's how the AI generated them in separate sessions. The auth middleware was written three different ways in three different places, all slightly different, all working.

When I asked the team why they used JWT with a 7-day expiration for a fintech product, nobody knew. When I asked why the rate limiter was applied at the route level instead of the middleware level, nobody knew. When I asked about the retry logic in the payment service that would retry a failed charge up to 5 times with exponential backoff, nobody had thought about what happens if the first charge actually went through but the confirmation was dropped.

The AI never told them any of these decisions were happening. It just made them.

I want to be careful here because I don't think AI coding tools are bad. I use them constantly. But there's a specific failure mode I keep seeing where teams move fast, the code works, nothing breaks, and six months later nobody on the team can answer basic architectural questions about their own system.

The AI didn't write bad code. It wrote code that nobody understood, and the code was good enough that nobody had a reason to understand it.

That's a different kind of risk than a bug.

Anyone else auditing or inheriting AI-generated codebases and finding this pattern? Curious if there are approaches that actually help teams maintain architectural understanding when AI is writing most of the implementation.