How to Verify AI-Generated Android Code Before Shipping

The most dangerous AI-generated code isn't the code that fails to compile. It's the code that compiles, passes a quick manual test, and fails for 2% of users after rotation, on slow networks or in release builds. Verification has to look exactly where those failures hide.

Verification layers

The checklist

1. Automated

• ☐ Builds cleanly with no new warnings you don't understand
• ☐ Lint passes (run ./gradlew lintDebug), and static analysis passes
• ☐ Unit tests added or updated for new logic, and they fail when the logic is broken

2. Understanding

• ☐ You can explain every line and why it's there
• ☐ Every API and dependency exists in the versions you use (checked in official docs)
• ☐ No dead code, unused parameters or leftover placeholder logic

3. Android correctness

• ☐ No I/O or heavy work on the main thread; no runBlocking
• ☐ Coroutines in lifecycle-aware scopes; CancellationException not swallowed
• ☐ No Activity, View or Context held in ViewModels or singletons
• ☐ State survives rotation and process death where it matters
• ☐ Flows collected lifecycle-aware (collectAsStateWithLifecycle, repeatOnLifecycle)
• ☐ Runtime permissions requested and handled when denied

4. Security and privacy

• ☐ No API keys, tokens or secrets in code or resources
• ☐ No logging of personal data or auth headers
• ☐ No disabled TLS or certificate validation, and no cleartext traffic added
• ☐ New components not exported unless required; intents validated
• ☐ Data safety and privacy disclosures still accurate

5. Quality

• ☐ Content descriptions, 48dp touch targets, sufficient contrast, TalkBack order
• ☐ Strings in resources; works at large font scale and in dark mode
• ☐ Lazy lists with keys; no expensive work in composition
• ☐ Loading, empty and error states handled

6. Release readiness

• ☐ Tested on a minified release build (R8) to catch reflection and serialization issues
• ☐ Tested on at least one real, mid-range device
• ☐ Feature flag or staged rollout for risky changes

Common AI mistakes, caught

// 1. Works until rotation: state in remember instead of saveable/ViewModel
var draft by remember { mutableStateOf("") }               // lost on rotation → rememberSaveable

// 2. Works in debug, crashes in release: reflective JSON without keep rules / codegen
val user = Gson().fromJson(json, User::class.java)         // R8 may strip/rename fields

// 3. Works on Wi-Fi, ANRs on slow networks: blocking call in a click listener
button.setOnClickListener { api.syncBlocking() }            // move to viewModelScope + suspend

Automate what you can

• CI runs lint, tests and a release build on every PR. See CI/CD with GitHub Actions.
• StrictMode and LeakCanary in debug builds catch threading and leak issues during manual testing.
• Screenshot tests catch visual and accessibility regressions in shared components.

Scaling the checklist

Frequently asked questions

Conclusion

Verify AI-generated Android code in layers: automated checks, full understanding, Android correctness, security, quality and release readiness on a minified build and a real device. That's how you get AI's speed without shipping its subtle mistakes.

Next step: secure your app more broadly with Android App Security Best Practices.