Should I security review ChatGPT code?

Every piece of ChatGPT-generated code should undergo security review before being used in production applications. The model does not have awareness of your application security context, threat model, or compliance requirements when generating code. Code that appears functional in development may contain subtle vulnerabilities that only manifest under adversarial conditions, such as race conditions, authentication bypasses, or insecure deserialization. Manual code review combined with automated scanning provides the strongest coverage. UNPWNED complements manual review by checking externally observable exposure, configuration, dependency, endpoint, CORS, form, rate-limit, and error-disclosure signals. Race conditions, authentication logic, and insecure deserialization require code review or targeted testing.