AINAScan — AI Code Security Scanner

The problem

AI-generated code has repeating patterns of failure

Claude, GPT, and Cursor reliably produce these bugs. They look correct on the surface. They break in production.

BLOCK MISSING_WRITE

# AI writes this — looks complete
def save_user(name, email):
    user = {"name": name, "email": email}
    return {"status": "saved"}
# No INSERT. Data silently vanishes.

BLOCK SQL_INJECTION_RISK

# Copy-pasted from every tutorial
def get_user(user_id):
    return db.execute(
        f"SELECT * FROM users
         WHERE id='{user_id}'"
    )

WARN FAKE_ASYNC

# async keyword, zero benefit
async def fetch_data(url: str):
    # Blocks the event loop
    return requests.get(url).json()

BLOCK COMMAND_INJECTION

# AI uses shell=True constantly
def run(cmd):
    subprocess.run(
        f"process {cmd}",
        shell=True  # ← exploit here
    )

These exact patterns appear repeatedly in AI-generated codebases. Semgrep missed them all.

Try it now

Scan your file

Free beta key included. No signup. Supports .py .js .ts .go .java .kt .php .rb .c .cpp

🔍 File Scanner Free · 50 files/day

📁

Drop your file here or click to upload

.py .js .ts .go .java .php .rb .kt .c .cpp

API Key

Analyzing AST…

📋 Full Pattern Checklist

Members Only

Member-Only Features

Star this repo on GitHub and sign in to unlock all features for free.

📦

ZIP / Folder Scan 🔒

Upload your entire project as a ZIP. All source files scanned in parallel.
Member only — up to 200 files per ZIP

📄

7-Section Auto Docs

Auto-generates project structure, function list, dependencies, Mermaid diagram, API endpoints, DB schema, and validation status as Markdown.

🔍

Scan History Dedup

Re-scanning the same file updates the previous result — no duplicate entries, clean history.

⚡

Dead Code / Dead Table

Detects functions never called from other files and DB tables unreferenced in any query.

⭐ Star on GitHub to Join Free →

You must star the repository to activate your account

New in v4.0

ZIP / Folder Scan 🔒

Upload a ZIP of your whole project. AINAScan checks every source file in parallel — up to 200 files.
🔒 Member only. ⭐ Star the repo & sign in to unlock ZIP scan.

📦

📂 폴더를 드래그하거나 .zip 파일을 올려주세요

🔒 Members Only

7-Section Auto Documentation

Upload a ZIP and get a 7-section Markdown document instantly — pure AST analysis, no LLM.

① Project Structure
File tree + fn/class/API counts

② Function Reference
name · line · params · return type

③ Dependencies
requirements.txt parsing

④ Mermaid Diagram
Module dependency graph

⑤ API Endpoints
FastAPI/Flask auto-detected

⑥ DB Schema
SQLAlchemy Column extraction

⑦ Validation Status
BLOCK/WARN summary per file

This feature requires membership. Star the repo on GitHub and sign in to unlock instantly.

⭐ Star on GitHub to Join Free

Detection

48 patterns across 9 languages

Security vulnerabilities + vibe-coding structural bugs. BLOCK = must fix before production. WARN = review recommended.

SECURITY — BLOCK (20 patterns)

💉SQL_INJECTION_RISKBLOCK

💻COMMAND_INJECTIONBLOCK

📂PATH_TRAVERSALBLOCK

🌐SSRF_RISKBLOCK

⚡EVAL_EXEC_RISKBLOCK

🔑HARDCODED_SECRETBLOCK

🤖LLM_OUTPUT_INJECTIONBLOCK

🤖LLM_SSRFBLOCK

🤖PROMPT_SQL_INJECTIONBLOCK

🎨TEMPLATE_INJECTIONBLOCK

📦INSECURE_DESERIALIZATIONBLOCK

🌍XSS_RISKBLOCK

↪️OPEN_REDIRECTBLOCK

🐛DEBUG_MODE_RISKBLOCK

🌐CORS_WILDCARDBLOCK

🚧BOUNDARY_MISSINGBLOCK

🗃️DB_SCHEMA_DRIFTBLOCK

⚠️TYPE_UNSAFE_ACCESSBLOCK

🔄CONSTANT_CONDITIONBLOCK

➗DIVISION_BY_ZERO_RISKBLOCK

VIBE-CODING STRUCTURAL — BLOCK (9 patterns)

💀STUB_SKELETONBLOCK

🎭MOCK_PATTERNBLOCK

📋HARDCODED_TABLEBLOCK

🔀TRIVIAL_IF_CHAINBLOCK

☠️DEAD_DB_RESULTBLOCK

🔌INPUT_OUTPUT_DISCONNECTEDBLOCK

🔒CONST_SQL_NO_PARAMBLOCK

↩️UNIFORM_RETURNBLOCK

🔤ENCODING_CORRUPTIONBLOCK

CODE QUALITY — WARN (19 patterns)

🚫FAKE_ASYNCWARN

💾MISSING_WRITEWARN

🗑️DEAD_CALL_RESULTWARN

🙈EMPTY_EXCEPTWARN

🔢MAGIC_NUMBERWARN

📝MUTABLE_DEFAULTWARN

🔐WEAK_CRYPTOWARN

🎲INSECURE_RANDOMWARN

🤫SILENT_FAILUREWARN

∞RECURSIVE_WITHOUT_BASEWARN

⚰️DEAD_BRANCHWARN

🔄INCONSISTENT_RETURNWARN

📄MISSING_PAGINATIONWARN

🔁ALIASED_STUBWARN

✅TRIVIAL_ASSERTWARN

🔧PARAMETER_MUTATIONWARN

👻PARAM_INTENT_IGNOREDWARN

🔗SHORT_PASSTHROUGHWARN

⚠️BARE_EXCEPTWARN

Comparison

What others miss

Compared against common static analysis tools. Synthetic test cases based on real AI-generated bug patterns.

Finding	AINAScan	Semgrep (free)	Bandit	Claude inline
COMMAND_INJECTION (shell=True + user input)	✅ BLOCK	❌	❌	❌
COMMAND_INJECTION (f-string in subprocess)	✅ BLOCK	❌	❌	❌
PATH_TRAVERSAL (open with user path)	✅ BLOCK	⚠️ partial	❌	❌
MISSING_WRITE (no INSERT in save fn)	✅ BLOCK	❌	❌	❌
FAKE_ASYNC (blocking event loop)	✅ WARN	❌	❌	❌
LLM_OUTPUT_INJECTION (AI output → eval)	✅ BLOCK	❌	❌	❌

Live stats

Pattern leaderboard

Most commonly detected patterns across all real-world scans. Updated live.

#	Pattern	Frequency	Count
Loading…

API

Integrate in 30 seconds

REST API. Free key included. Works with any language that can do HTTP.

bash

# Scan a file (free — no signup)
curl -X POST https://pleasing-transformation-production-90c2.up.railway.app/v1/scan \
  -H "X-API-Key: vg_free_test" \
  -F "file=@your_file.py"

# Get auto-fix suggestions
curl -X POST https://pleasing-transformation-production-90c2.up.railway.app/v1/fix \
  -H "X-API-Key: vg_free_test" \
  -F "file=@your_file.py"

# Install CLI
pip install aina-scan
aina-scan config --key vg_free_test
aina-scan scan your_file.py

Trust & Privacy

We never see your code.

This isn't a policy promise — it's the architecture. Here's exactly what happens to your files.

🔬

Analyzed in memory, never saved

Your file is read into RAM, scanned by our AST engine, and the buffer is released immediately. No file is written to permanent storage. Python temp files used during analysis are deleted within the same request lifecycle.

🗄️

What we actually store

We store: filename (not path), issue type (e.g. COMMAND_INJECTION), line number, severity.

We never store: source code, function bodies, variable values, file contents, or any data that can reconstruct your code.

📋

Scan history is yours

Scan history (filename, verdict, timestamp) is stored per API key in server memory — it resets on redeploy. We don't persist scan results to a database. Member login stores only your GitHub public profile (login, avatar) via OAuth.

✅

Verifiable — not just a promise

The api.py source is the entire backend. You can scan it with AINAScan itself (we do). No hidden services, no data pipelines, no analytics SDKs. SQLite schema: fp_store (FP reports), users (GitHub profile), vg_scan_log (vuln_type + 0/1 flag only).

Member ZIP / Folder Scan limits: 20 scans/day · 500 MB total upload/day · resets at midnight UTC.
These limits exist to prevent abuse — not to monetize your usage. Normal development workflows (scan once per PR, a few times per sprint) will never hit them.

Free period: All member features are free until June 30, 2026. After that, ZIP scan and auto-docs will require a Pro subscription ($19/mo). Single-file scan stays free forever.

AI writes the bugs.AINAScan catches them.

AI-generated code has repeating patterns of failure

Scan your file

Member-Only Features

ZIP / Folder Scan 🔒

7-Section Auto Documentation

48 patterns across 9 languages

What others miss

Pattern leaderboard

Integrate in 30 seconds

We never see your code.

AI writes the bugs.
AINAScan catches them.