Scaffold boilerplate left uncustomised
Part of the AI-generated code risks check · fix arrives as a guide
What it is
Generated or template scaffolding was never customised: default project names, example route handlers, placeholder copy, or a starter config left at its shipped values.
Why it matters
Boilerplate defaults are public knowledge, and some of them are security-relevant — a starter session secret or a demo admin account is the same on every project that skipped this step.
How to fix it
Work through the scaffold and either customise or delete each leftover. Pay particular attention to any generated secret, seeded account, or permissive default the template shipped to make the first run easy.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.