Our team of 4 developers is building a SaaS product using Next.js and Supabase, and we now use Cursor and GitHub Copilot for almost everything. Our velocity is 3x faster, but I'm noticing a new kind of technical debt: duplicated logic, overly generic functions, missing edge-case handling, and packages the AI hallucinated or chose that are not maintained.
We already have ESLint and basic PR reviews, but it's not enough. For teams that have been working like this in production for a while:
What is your review process for AI-generated code? What checklist do you follow?
How do you enforce consistent architecture and prevent the AI from creating 5 different ways to do the same API call?
What tools or practices have you adopted to catch AI-introduced security issues (hardcoded secrets, insecure dependencies, SQL injection patterns)?
I'm looking for real-world workflows you've implemented, not just "review carefully". Any references to engineering blogs or open-source contribution guides that address AI-generated code would be very helpful.