Skip to content
Daniel TorresConnect

Case study 04 · Static analysis for AI-written code

Vibe Code Security Scanner

AI writes code fast. This checks it before it ships.

Single file · runs locally

Film shows the scanner on a small synthetic project with example-only secrets.

01Program challenge

Teams now ship scripts, pages and infrastructure code written with AI assistants. Those files often carry the same handful of mistakes: unsafe DOM sinks, missing content security policies, hard-coded secrets, shell injection and wide-open cloud rules.

Code that reaches a mission network or a production account without review becomes a vulnerability someone else has to find later.

02Leadership decision

Requirements
Defined the coverage around the file types AI assistants actually produce in security and operations work.
Stakeholders
Developers and engineers who write with AI help, and the reviewers who approve their changes.
Trade-off
Chose transparent pattern rules with documented limits over a heavier engine, keeping it a single file anyone can run.

Key decisions

Severity and confidence are separate

A high-severity pattern seen with low confidence is labeled that way, so reviewers can prioritize honestly.

State the limits on the page

Static analysis cannot see response headers, runtime traffic or backend authorization. The tool lists those as manual verification items instead of implying coverage it does not have.

Nothing is uploaded

Files and folders are analyzed in the browser, so it can be used on code that must not leave the machine.

03Engineering solution

  • Rule sets for HTML, JavaScript and Node, Python, PowerShell, Bash, Dockerfile, Compose, Kubernetes, Terraform and YAML or JSON configuration, plus a secrets scan for any text file.
  • An AI-generated code profile that marks and surfaces the mistakes AI makes most.
  • A release gate with explicit failure conditions by severity, confidence and finding type.
  • For every finding: the exact line, why it matters with its CWE, how to fix it, and its OWASP category.
  • Reports as text, JSON, Markdown or HTML.
  1. Step 1

    Drop files or a whole project folder

  2. Step 2

    Read the gate verdict

  3. Step 3

    Open a finding for the line, the risk and the fix

  4. Step 4

    Export the report for the ticket or pull request

04Operational impact

A pass or fail verdict against a stated policy, with each failure traced to a line of code and a concrete fix.

Profiles and gates let a team adopt it with a default policy and tighten it later.