SECURITY FOR AI-BUILT APPS

Your app ships fast.
But is it safe?

AI coding turns ideas into products in days. Payment flows, admin panels, login walls — all working on the surface. We find what AI-generated code hides — leaked keys, missing guards, invented dependencies — before your users do.

Scan without uploading Scan on this site

Runs on your machine or in your CI — we never receive your source. Prefer we do it for you? Upload instead.

findings.log summary.pdf
01CRITsrc/middleware/auth.ts
02CRITsrc/api/webhook.ts
03HIGHsrc/routes/admin/
04MEDenv/.local
05MEDsrc/lib/cors.ts
06LOWsrc/api/ratelimit.ts
07INFOREADME.md
6 findings 2 critical · 1 high
Start here — no upload

Don't send us your code. Run the scanner yourself.

The engine is open source under AGPL-3.0. Run it on your machine or inside your own CI and your source never leaves it — we receive nothing. It's the same engine that powers this site, so the score is identical either way.

On your machine

npx github:odbd/oh-my-audit-free scan ./

Node 20+. Add --markdown for a report file, or --fail-on critical for a hard gate.

In Docker (scanners bundled)

docker run --rm -v "$PWD:/src" ghcr.io/odbd/oh-my-audit-free scan /src

No local setup: gitleaks, semgrep and osv-scanner ship inside the image.

In your CI, on every pull request

- uses: odbd/oh-my-audit-free@v1
  with:
    fail-on: critical

Runs in your own runner. No app to install, no repo access to grant, nothing sent out. Findings land in your Security tab via SARIF.

Why this is the honest default

  • You can read every rule before you run it — no black box, no telemetry.
  • The only network call is an opt-in check that a dependency exists on npm, and it sends package names, never code.
  • Reproducible: the hosted scan and your local scan run the same engine and produce the same score.
Read the engine on GitHub

Want the report without the setup?

Upload a zip or connect a repo here and we run the same scan for you, then generate a shareable, printable audit report. Uploaded source is deleted after the scan.

Scan on this site instead
Before you upload

What happens before the score

You are not dropping code into a black box. The upload is kept private, the first pass stays limited, and the result helps you decide whether deeper review is worth paying for.

Private storage

Your archive is stored as a private object with a server-generated name, then automatically deleted after 7 days. No public URL is made for the zip.

Real launch edges

Auth, admin routes, payments, webhooks, secrets, uploads, and user data. The places fast launches usually trip over.

A score, then a decision

Free scans give you every finding with its file and fix. Buy an issued report when you need a dated document someone else can rely on.

Upload source only. Leave out generated files, dependency folders, logs, and .env or credential files.

AI SECURITY SCORE

Upload your source zip. We'll email you when the score is ready.

Start with two free scans. Results show a security score, launch-risk level, and signal counts in My Page.