AI-code security scanner: what the category is for, and what to expect from one

AI-generated code has a known failure profile, so the scanner should be built around it rather than around a generic rule catalogue. That means heavy emphasis on committed secrets (the single most common and most damaging issue), injection-prone string-built queries, dangerous configuration defaults like debug mode and wildcard CORS, files that shouldn't be in the repo, unpinned dependencies, and disabled TLS checks.

secure·vibes organises exactly these into six weighted categories — secrets & credentials at 30, injection & unsafe code at 20, auth & access control and data exposure at 15 each, dependencies & supply chain and transport & TLS at 10 each — so the score reflects how much each kind of mistake actually matters, not just how many findings there are.

A finding that says "potential injection risk detected" is useless to someone who isn't a security engineer. A useful finding has five parts: the severity, the exact file and line, evidence (redacted when it's a secret), a plain explanation of why it matters, and a concrete fix. That's the format every secure·vibes finding follows, ranked so the worst issues are at the top.

Frictionless input matters too. The person this category serves won't configure a CI pipeline or install a CLI — they'll paste a link. secure·vibes takes a public GitHub repo URL, fetches the same public archive anyone can download, scans it in memory without cloning to disk, and typically returns the report in under a minute. No OAuth, no setup.

Here's the category's defining move: if the app was built by prompting a coding agent, the fixes should be prompts. secure·vibes generates a ready-to-paste Claude prompt for every finding — stating the issue, the location, why it matters, the exact fix, and constraints like "smallest diff" and "check for the same pattern elsewhere" — plus a fix-everything mega-prompt that works through all findings in severity order.

And the honest boundary: this category is heuristic static analysis. secure·vibes doesn't execute your code, doesn't check dependencies against a vulnerability database, and isn't a penetration test. If you're an enterprise with compliance requirements, you need the enterprise stack; if you're a builder who shipped fast and wants the predictable mistakes caught and fixed, this is the tool shape that fits.