Check what AI tools actually get wrong
AI-generated code has a known failure profile, so the scanner should be built around it rather than around a generic rule catalogue. That means heavy emphasis on committed secrets (the single most common and most damaging issue), injection-prone string-built queries, dangerous configuration defaults like debug mode and wildcard CORS, files that shouldn't be in the repo, unpinned dependencies, and disabled TLS checks.
quality·vibes sorts these into six weighted categories: secrets & credentials at 30, injection & unsafe code at 20, auth & access control and data exposure at 15 each, dependencies & supply chain and transport & TLS at 10 each. The score then reflects how much each kind of mistake matters, not just how many findings there are.
Findings a builder can act on
A finding that says "potential injection risk detected" is useless to someone who isn't a security engineer. A useful finding has five parts: the severity, the exact file and line, evidence (redacted when it's a secret), a plain explanation of why it matters, and a concrete fix. That's the format every quality·vibes finding follows, ranked so the worst issues are at the top.
Frictionless input matters too. The person this category serves won't configure a CI pipeline or install a CLI. They'll paste a link. quality·vibes takes a public GitHub repo URL, fetches the same public archive anyone can download, scans it in memory without cloning to disk, and typically returns the report in under a minute. No OAuth, no setup.
Fixes in the language of the tools that built the app
The category's defining move: if the app was built by prompting a coding agent, the fixes should be prompts. quality·vibes writes a ready-to-paste Claude prompt for every finding, stating the issue, the location, why it matters, the exact fix, and constraints like "smallest diff" and "check for the same pattern elsewhere". There's a fix-everything mega-prompt too, working through all findings in severity order.
Then the boundary. This category is heuristic static analysis. quality·vibes doesn't execute your code, doesn't check dependencies against a vulnerability database, and isn't a penetration test. An enterprise with compliance requirements can't run on it alone and needs the enterprise stack. A builder who shipped fast and wants the predictable mistakes caught and fixed is looking at the right tool shape.
What to expect from an AI-code security scanner, using quality·vibes as the example
| Capability | What a good one does | quality·vibes |
|---|---|---|
| Input | Zero setup: no CI, no CLI, no OAuth | Paste a public GitHub repo link |
| Coverage | The mistakes AI tools predictably make | Six weighted categories, secrets heaviest at 30 |
| Findings | Severity + file + line + why + fix | All five, ranked, with secrets redacted |
| Output for fixing | Something your coding agent can apply | A Claude prompt per finding + a mega-prompt |
| Speed | Fast enough to run before every ship | Typically under a minute |
| Limits, stated plainly | Static heuristics, not a pentest | No code execution, no vuln database, not a pentest |
frequently asked
How is this different from the security tools companies already use?
Enterprise SAST/SCA tools do vulnerability-database dependency analysis and CI integration for security teams. An AI-code scanner like quality·vibes does fast heuristic repo scans with fixes formatted for coding agents, aimed at solo builders. Different user, different job. Our comparison page has the full breakdown.
Does 'AI-code scanner' mean it uses AI to scan?
The name is about what it scans and who it serves: codebases built with AI tools, checked with pattern-based static analysis. The AI-native part is the output, fixes delivered as prompts your coding agent can apply directly.
What can't a scanner like this catch?
Anything that requires running the code (runtime behaviour, business-logic flaws) or a vulnerability database (known CVEs in specific dependency versions). quality·vibes flags structural dependency risk like missing lockfiles, "latest" versions, and raw-URL installs, but it isn't a CVE checker or a pentest.
What does quality·vibes cost?
Free: two scans on Claude Haiku, no card, with the full score, all six subscores, every finding, every fix and prompt, and the fix-everything mega-prompt. Paid: $5 a scan, in packs of 1, 3 or 10, with every scan reviewed by Claude Opus 5 over the whole repo, or by a Claude Fable 5 deep audit when you want the strongest model on it. No subscription, and scans you've bought don't expire.
Last updated June 10, 2026