🔍 AI Code Security Scanner
Scan JavaScript and TypeScript code for security issues — hardcoded secrets, SQL injection, XSS, path traversal, and eval usage.
About this tool
The AI Code Security Scanner analyzes JavaScript and TypeScript code for common security vulnerabilities. Paste your source and it identifies hardcoded secrets, SQL injection points, cross-site scripting (XSS) vectors, path traversal risks, and dynamic code execution.
Each finding includes the line number, severity (critical / high / medium / low), a description of the issue, and the relevant code snippet. Use the results as a quick first pass before manual review or SAST tooling in CI.
What it catches: hardcoded API keys, passwords, and tokens (GitHub, OpenAI, AWS, Slack); SQL queries built with string concatenation; innerHTML without sanitization; eval() and new Function(); and filesystem operations with unsanitized user input.
FAQ
Is this a replacement for a SAST tool? ›
No — this is a fast first-pass scanner that runs entirely in the browser. It catches the most common patterns but does not perform data-flow or taint analysis. Use it for quick checks during development, but pair it with a full SAST pipeline (Semgrep, CodeQL, SonarQube) for production-grade coverage.
Does the scanner detect vulnerabilities in dependencies? ›
No. Dependency scanning (supply-chain vulnerabilities) requires knowledge of your package.json lockfile and known CVE databases. Use <code>npm audit</code>, Snyk, or Dependabot for that.
Will it produce false positives? ›
Yes, pattern-based scanning is inherently noisy. A <code>static readonly SECRET_KEY</code> in a config may be flagged even if it is safe in context, and <code>innerHTML</code> assignments after sanitization are flagged unless the sanitizer call is on the same line. Treat every finding as a prompt to investigate, not a guaranteed bug.