How do you run a security review on code that came out of a model?

I apply the same security fundamentals I'd apply to any code. Validate inputs, parameterize queries, never build shell commands from user data, keep secrets out of source, least privilege everywhere. Generated code just gets extra scrutiny, because the model doesn't know our threat model or which inputs are attacker-controlled. So I check the authentication and authorization paths carefully, I look at how errors are handled so we're not leaking internals, and I make sure any crypto uses standard libraries rather than something homemade. On dependencies I stick to well-known packages and run the usual audit tooling. The model produces plausible code, and security is kind of where plausible gets dangerous, so a human review is always required. That's the rule I'd hold no matter what.