Responsible AI Usage

OpenSSF Security-Focused Guide for AI Code Assistant Instructions is our baseline for AI-assisted development.

Beyond human review, we rely on CI pipelines to catch mistakes that AI code may introduce. Pull requests run locked dependency installs, TypeScript checks, linting, backend and SDK unit tests, billing-focused regression tests, schema and migration guards, SSR production builds, package build verification, and secret hygiene scans before release work can continue.

These CI pipelines protect against common AI failures such as invented or unsafe dependencies, code that typechecks locally but breaks a build artifact, missing database migrations (drizzleORM), accidental secret leaks, broken public routes, unsafe deployment diagnostics, optional peer dependency breakage, and mobile install or packaging regressions. Docker images, SDK publishing, and deploy steps only run after the relevant validation jobs pass.