Before an AI-built prototype ships, remove unused packages, dead and debug routes, hard-coded test users, sample keys, commented-out experiments and generated files you did not intend to commit. Then rebuild from a clean checkout to prove the app still works without them.
Why cleanup is a security task
Rapid prototyping with AI tools produces a lot of sediment. Each attempt that did not work leaves behind a package, a route or a file. Attackers do not care that the code is unused. An abandoned route still answers requests, and an unused package still sits in your dependency tree.
The cleanup list
Dependencies. List everything in the manifest and ask if the code imports it. Remove what it does not. After each removal, reinstall and run the tests. A smaller tree means fewer advisories to read later.
Routes and endpoints. Search for routes named test, debug, admin, seed, reset or temp. Delete them, or protect them with real authentication if they must stay.
Test accounts and seeded data. Remove default users and passwords created for demos. If a seed script exists, make sure it cannot run in production.
Keys and tokens. Search the code and the history for anything that looks like a credential. If a real one was ever committed, revoke or rotate it. GitHub's guidance says the first step for a leaked secret is to revoke or rotate it, because rewriting history may not be warranted once the secret no longer works.
Debug settings. Turn off verbose errors, stack traces in responses, open cross-origin settings used for local testing, and any flag that disables a check.
Generated clutter. AI tools often create scratch files, notes and example configs. Check git status, and add build output and local environment files to .gitignore.
Prove it with a clean build
Cleanup is not finished until the project builds from a fresh clone. Do this:
- Clone the repository into an empty folder.
- Install with the lockfile-respecting command for your package manager.
- Run the tests and start the app with only the documented configuration.
- If anything fails because a deleted thing was secretly needed, fix the dependency honestly rather than restoring the shortcut.
A note on generated tests
AI tools often write tests that pass because they assert whatever the code already does. Before you rely on them for the clean build check, read a few. A test that would still pass if you deleted the feature is not protecting anything. Add at least one test for the behavior you care about most, such as a user being refused another user's data.
Keep a record
Write the cleanup into the pull request description: what you removed and why. It helps the reviewer and it becomes useful evidence later, for example when a customer asks how you manage changes.
Where Safeguard fits
Safeguard's dependency scanning and SBOM generation give you a before-and-after view of the dependency tree, so you can see the removals took effect. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is deleting a leaked key from the repository enough?
No. Treat any exposed key as compromised and revoke or rotate it. Removing it from the files does not remove it from history or from anyone who already copied it.
How do I find unused dependencies?
Compare the manifest against actual imports, remove candidates one at a time, and run the tests after each removal. Several ecosystems have tools that automate the comparison.
Sources
Last reviewed: 19 October 2026.
