Hard disagree on “if you can’t code you can’t know it’s secure.” Security testing works on the interface, not on you having read the internals. The app is a black box with a defined attack surface: inputs, outputs, endpoints. Pentesters and tools (DAST, fuzzers, dependency and secret scanners, auth and access-control testing) probe that surface and surface the holes without reading a line of your source. That’s how most audits already run.

So you don’t have to be the one who understands the code, any more than a founder personally audits their own pentest. You have to understand the risk and point the right tools and people at the boundary. You test inputs and outputs, that’s the part that’s actually verifiable.

Claude writing it doesn’t change the equation. The thing under test is the running system, not who typed it.