AI-Assisted Code Generation in Full-Stack JavaScript Development: A Structured Survey of Productivity, Correctness, and Security Evidence

Coding assistance and autonomous code generation agents now feature auto-completion, auto-generation, and auto-execution of code. JavaScript is mainly difficult because of its large browser and server runtimes, full-stack web setups, and large package ecosystems, and the evidence on JavaScript code is scattered across 52 papers (20212026) in the areas of AI programming productivity, functional correctness, and security. We define a search protocol, identify experiments' evaluation units and quality attributes, compare evaluation oracles, and build a taxonomy of the security risks reported. A search-sensitivity analysis indicates that 37 out of 49 primary studies (75.5%) were identified using the search strings, while 11 (22.4%) were found through snowballing. Three main findings are presented. First, productivity outcomes vary by context: field experiments indicate improvements, while a randomized trial involving experienced maintainers on mature repositories reports a 19% slowdown. Second, recurring security issues are identified across designs, like cross-site scripting, code injection, weak access control, hard-coded secrets, and hallucinated npm packages. Third, exploit-validated security evaluation exists for backend and repository-level tasks, but full-stack web benchmarks focus only on functionality, and application-level security evidence for JavaScript is limited to a few small studies, each examining no more than a dozen applications. The paper ends with a research agenda emphasizing exploit-validated, layer-attributed benchmarks for full-stack JavaScript applications.