Source code
Security & compliance
Code quality
Releases
Stability
AI-generated code risks
The mistakes coding agents make confidently, and repeatedly.
Overview
Generated code compiles, passes review at a glance, and carries a recognisable set of defects. This check reads your source for the patterns that show up when auth, crypto, or query-building was written by a model and merged without a close read.
What it looks for
- JWTs decoded instead of verified, or verified without pinning an algorithm
- MD5, SHA-1, or low-cost bcrypt on passwords, and deprecated crypto primitives
- eval and dynamic exec reached by user input
- String-built SQL, path traversal, open redirects, and SSRF sinks
- Secrets left in comments, TLS verification switched off, scaffold defaults never changed
- Calls to APIs that do not exist, and @ts-ignore hiding the type error that would have caught them
Why it matters
These are not style problems. A JWT verified without an algorithm check accepts a token signed with none. A password hashed with MD5 is a password already leaked. Both look completely ordinary in a diff.
Rules in this check
How the fixes arrive
Pull requestLow-risk changes arrive as a pull request on a lumioguard branch, with a breakage analysis attached. You review and merge it.
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.