Audit AI-generated code for the vulnerabilities it introduces

AI pattern-matches to the examples it was trained on, including the insecure ones. Guard audits both the code and the live app you authorize for the vulnerability classes that slip past a fast review.

Run a free audit Request a demo

1 repo · setup in about 5 minutes · no card, no commitment

Report

The vulnerability classes Guard checks for

Executive Summary

AI pattern-matches to the examples it was trained on, including the insecure ones. Guard audits both the code and the live app you authorize for the vulnerability classes that slip past a fast review.
Guard combines source review with bounded runtime checks against staging or production targets you authorize, so the web-app evidence sits next to the code.
Findings come back in plain language: what is exposed, who can reach it, and what it costs if someone does. No CVE firehose, no noise to wade through, the signal a founder can read and an engineer can verify.
Findings come back as reviewable GitHub issues with evidence and rationale. When a fix is bounded and useful, Guard can open a narrow pull request for human review.

Audit Target and Version

Repository: checkout-service
Default branch: main
Checked commit: mocked-build-reference

What We Checked

Secrets, tokens, and keys hardcoded into reachable routes
Broken authentication and missing access control
User input trusted into queries, commands, or file paths
Objects and records reachable without an ownership check
Over-permissive CORS, headers, and exposed internal routes

Findings

PriorityWhat we foundWhere to lookHighSecrets, tokens, and keys hardcoded into reachable routesroutes/api/session.tsMediumBroken authentication and missing access controlauth/guard.tsMediumUser input trusted into queries, commands, or file pathsdb/query.tsLowObjects and records reachable without an ownership checkmodels/account.tsLowOver-permissive CORS, headers, and exposed internal routesconfig/web.ts

AI writes confident, plausible, sometimes insecure code

An assistant will happily generate an endpoint that returns a secret, an auth check that never runs, or input handling that trusts whatever it is given. It looks correct, the tests are green, and the pull request gets approved. The vulnerability ships anyway. AI-generated code security is its own failure mode: the code reads as correct, so the risk hides in plain sight.

The vulnerability classes Guard checks for

Guard audits the AI-generated code vulnerabilities that show up most often:

Secrets, tokens, and keys hardcoded into reachable routes
Broken authentication and missing access control
User input trusted into queries, commands, or file paths
Objects and records reachable without an ownership check
Over-permissive CORS, headers, and exposed internal routes

Source review plus bounded runtime checks

Guard combines source review with bounded runtime checks against staging or production targets you authorize, so the web-app evidence sits next to the code.

Severity you can actually triage

Findings come back in plain language: what is exposed, who can reach it, and what it costs if someone does. No CVE firehose, no noise to wade through, the signal a founder can read and an engineer can verify.

From finding to fix

Findings come back as reviewable GitHub issues with evidence and rationale. When a fix is bounded and useful, Guard can open a narrow pull request for human review.

enji-guard/checkout-servicePrivate

From finding to fix

Open

Enji Fleetbotopened issue #184

Findings come back as reviewable GitHub issues with evidence and rationale. When a fix is bounded and useful, Guard can open a narrow pull request for human review.

enji-guard/checkout-servicePrivate

From finding to fix

Open

Enji Fleetbotopened pull request #185

Findings come back as reviewable GitHub issues with evidence and rationale. When a fix is bounded and useful, Guard can open a narrow pull request for human review.

src/routes/account.ts1 changed file

18- const token = process.env.ADMIN_TOKEN || req.query.token

18+ const token = requireServerSession(req)

19+ if (!token?.userId) return forbidden()

20 return loadAccount(token.userId)

Quick questions

Is AI-generated code actually less secure than human code?

Not always less secure, but insecure in more predictable ways. It confidently reproduces patterns from its training, including the bad ones, so the same flaws show up again and again.

What vulnerabilities are most common in AI code?

Hardcoded secrets in AI-generated code, auth checks that never run, and untrusted input flowing straight into a query or command. They pass review because the code reads cleanly and the tests are green.

Does it check for leaked secrets and risky dependencies too?

Yes. The audit covers secrets committed into reachable code and dependency risks like hallucinated packages, dependency confusion, or abandoned packages, not just logic flaws.

Will I get a wall of CVEs to wade through?

No. Findings come back in plain language with severity, evidence, and likely exposure, so a founder can read it and an engineer can act, instead of triaging noise.

Find the vulnerabilities your AI shipped.

Connect a repo and get your first vulnerability report in a few minutes. No card.

Run a free audit Request a demo

Keep exploring

Runtime security testing

Check linked web apps with bounded runtime security checks.

Dependency & supply-chain shield

Catch hallucinated and risky packages before they ship.

Automated code remediation

Turn vulnerability findings into reviewable pull requests.