Your next customer will ask for a security review.
Paste a repository. In about a minute you will see what your AI assistant left behind, with the file and the line — and something to say when the questionnaire arrives.
Public repositories on GitHub and GitLab. Nothing is executed and no code is stored — we read the files, record the findings, and drop the copy.
What it looks for
Six of the OWASP Top 10. Not five hundred findings.
A general-purpose scanner hands a three-person team four hundred findings, and four hundred findings get ignored. These are the OWASP categories that AI assistants get wrong most often — and every rule is measured against real repositories before it ships. On mature, well-reviewed code, our findings go to zero.
- A01Broken Access ControlTables exposed without row-level security, policies that allow everything. The most common authorization failure in AI code — 'who is allowed to do this' rarely makes it into the prompt.
- A03InjectionUnescaped output, SQL built by concatenation, shell commands and eval() fed with request data. The classics — and what the training data is full of.
- A05Security MisconfigurationWildcard CORS with credentials, debug mode left on in production, driver errors leaking your table names straight to the client.
- A06Vulnerable DependenciesKnown CVEs in your direct dependencies — checked against the resolved version in your lockfile, and only flagged when a fixed release actually exists to upgrade to.
- A07Authentication FailuresAPI keys and provider secrets hardcoded in the file; a Supabase service key that bypasses every access rule, shipped to the browser.
- A09Logging FailuresPasswords and authorization headers written to logs in plaintext, where retention is long and far more people have access than to the database.
Why this exists
The review is the thing you hand over.
Most teams shipping AI-written code are not looking for a security program. They are looking for an answer to one question from one buyer, usually with a deadline attached.
The tools built for that question are sold on annual contracts to people with a security title. If your whole company is four people, nobody is selling to you — so this is built for the other end: install it, get an answer, move on.
We are honest about the edge of it. This maps to five of the OWASP Top 10 — the categories you can actually catch by reading code, in JavaScript, TypeScript, Python and SQL. We do not claim the whole list: half of it, like insecure design and SSRF, only shows up at runtime. Anyone selling you full OWASP coverage from a code scanner is selling you something.