Detailed Analysis
CodeInspectus, an open-source, locally-run static analysis tool, has been updated to expand its detection coverage to 32 total checks: 13 checks specifically designed for AI-generated code vulnerabilities and 19 traditional static application security testing (SAST) checks, alongside more than 200 secret and API-key detection patterns. The tool, posted to r/ClaudeAI by its developer, is positioned as a security layer for developers who rely heavily on AI coding assistants like Claude to generate application code, running entirely on the user's machine without sending code to external servers.
The AI-specific checks reveal a growing awareness of failure modes unique to LLM-assisted development. Several checks target Supabase misconfigurations — such as service_role keys exposed in client-reachable code, Row-Level-Security policies with permissive `USING (true)` clauses, tables created without RLS entirely, and Edge Functions lacking auth checks — which have become notorious sources of real-world data breaches in vibe-coded applications. Other checks address LLM-specific attack surfaces directly, including SDK clients configured with `dangerouslyAllowBrowser:true` (which leaks API keys to the browser), untrusted input flowing into LLM prompts (a prompt-injection risk), and model output rendered as raw HTML in React via `dangerouslySetInnerHTML`, which creates XSS vulnerabilities. These patterns reflect a documented trend: AI coding assistants frequently generate functional-looking code that omits authorization boundaries or security scaffolding a human engineer would typically add by default, since the models optimize for working demos rather than defense-in-depth.
This matters because the rapid adoption of AI-assisted and "vibe coding" workflows — where non-experts or time-pressured developers ship applications largely written by tools like Claude Code, Cursor, or v0 — has outpaced the guardrails needed to catch subtle security regressions. Anthropic and other model providers have increasingly emphasized that Claude and similar models are not inherently security-aware by default; they generate plausible, working code, not necessarily hardened code, unless explicitly prompted or checked. A local, open-source scanner tailored to these gaps addresses a real gap in the tooling ecosystem, since generic SAST tools built for traditional hand-written codebases often don't check for AI-era failure patterns like exposed Supabase keys or client-side environment variable leaks (`NEXT_PUBLIC_`, `VITE_`, `PUBLIC_` prefixes), which are increasingly common as AI tools scaffold full-stack apps quickly.
More broadly, this fits into a wider trend of the developer community building supplementary safety infrastructure around AI coding tools rather than waiting for foundation model providers to solve the problem end-to-end. As AI-generated code becomes a larger share of production codebases, third-party auditing tools, secret scanners, and now AI-specific SAST checks are emerging as a necessary complement to model-level safety training. The emphasis on full local execution and open-source transparency also speaks to a parallel trend of security-conscious developers preferring tools that don't require sending proprietary code to another cloud service, especially when the tool's purpose is to catch security flaws in the first place. Projects like CodeInspectus illustrate how the ecosystem around AI coding assistants is maturing beyond raw code generation toward a fuller pipeline that includes generation, review, and hardening.
Read original article →