Your login works. So does the pen test that destroys it.

AI-generated authentication is dangerous precisely because it looks right and functions right — while the security model underneath is Swiss cheese. A working login screen proves nothing about what's behind it.

Here's the demo that fools everyone, including the person who built it: login works, signup works, password reset sends the email. Every visible surface behaves. Then someone points even a basic pen test at it, and the whole thing comes apart — because the model shipped the behaviour of auth without the discipline of auth. It stored passwords in plaintext or MD5 crackable in seconds. It minted session tokens that never expire. It left login endpoints with no rate limiting, reset links that work forever, and admin access hanging off a boolean anyone can flip.

You won't find any of this by clicking around your own app. You find it by auditing the internals — every time, no exceptions. AI doesn't have that discipline unless you demand it explicitly, and even then it misses edge cases. So the discipline has to be yours.

Two checks from this doctrine

Real value, not a teaser — two of the 5 checks in full. The rest are in the one-pager.

A login that works is a claim. A pen test is the proof — run your own before someone else does.