Find common security risks in AI-generated web code.
Understand the evidence. Keep control of your code.
CODE SECURITY. IN FOCUS.
Development only. Public visitors never need to enter a server URL or API key.
Import source from a public GitHub repository or a single source file.
Repository root, /blob/ file, or raw.githubusercontent.com link. Up to 50 files · 250 KB per file · 2 MB total. GitHub receives requests from your browser. Private repos are not supported.Your findings, evidence and review priorities will appear here.
Results are potential findings, not confirmed exploits. “No findings” does not mean the application is secure. Exports include file names but omit source evidence for privacy; review file names before sharing.
Know exactly what is checked, and what each signal means.
500 review rules mapped to CWE and OWASP Top 10:2025 categories.
A small, transparent security review tool for your next AI-assisted build.
Pasted and uploaded code is analyzed in your browser. GitHub imports use public GitHub APIs directly. Source code is never executed, sent to an AI model, stored by this app, or rewritten.
No third-party scripts or remote fonts are loaded. No account credentials or GitHub tokens are requested. Closing or reloading the page clears the current source and report.
22 bounded, line-based pattern rules run in a cancellable worker and identify suspicious API calls, literal credentials, and insecure settings. Findings include file, line, potential severity, pattern confidence, CWE and context.
Confidence describes how clearly the pattern matches—not whether the application is exploitable. There is no AST, taint analysis, code execution or cross-file tracing. Analysis stops after 10 seconds; reports retain at most 500 matches and explicitly identify truncation.
Multiline expressions, wrappers, aliases and language variations may be missed. Comments, string literals, test fixtures and safe input can produce false positives. A snippet may omit security controls elsewhere.
Dependencies are not checked against CVE databases. Authorization, business logic, uploads, rate limits and runtime behavior need dedicated review and tests.
الصق الكود أو ارفع الملفات أو أدخل رابط مستودع GitHub عام، ثم ابدأ الفحص. كل نتيجة هي اشتباه يحتاج مراجعة: اقرأ السبب ورقم السطر وتأكد من مصدر البيانات والضوابط الموجودة.
الأداة لا تصلح الكود ولا تثبت أن الموقع آمن. درجة الخطورة تقديرية وليست CVSS. يمكنك تنزيل تقرير JSON أو Markdown، أو حفظه PDF من نافذة الطباعة.
Rule selection is informed by established web security guidance. These resources do not validate this implementation or imply complete OWASP coverage.
OWASP Top 10:2025 ↗ OWASP Secure Code Review Cheat Sheet ↗ MITRE Common Weakness Enumeration ↗ Research checked 11 October 2026 · Manara Pattern Review 1.1