AI Wrote Your Code. Nobody Checked It for Security Holes — So I Built a Scanner

Vibe coding is fast. You describe it, Cursor or ChatGPT or v0 writes it, and it works. What nobody does in that loop is read the code for security.

That's how secrets end up in production. I keep seeing the same holes in AI-generated code: API keys hardcoded in the source, SQL queries built with string concatenation, user input rendered straight into the page, CORS set to allow everything, no security headers at all, passwords hashed with MD5.

The AI doesn't do this to hurt you — it just writes the shortest path to "it works." Security isn't in the prompt unless you put it there.

So I built AIScan (https://aiscan.akclnt.com) — a free scanner for AI-generated code. Paste your code or upload a file (or a whole project as a ZIP) and it runs 32 checks on a single file, 35 checks on a full project: exposed API keys, SQL injection, XSS, insecure CORS, missing security headers, weak password hashing, and more.

Two things I deliberately kept:

Find-only, no auto-fix. It tells you what's wrong and gives you a copy-paste fix prompt to hand back to your AI. You stay in control — nothing gets rewritten behind your back.
Nothing leaves your browser on a single-file scan. Your code isn't uploaded anywhere to be checked.
There's also a daily security news page if you want to keep up with what's breaking, and a Pro Report ($19, waitlist) and a Done-For-You review ($149) if you want a human to go through it.

My question for you: what's the worst security hole you've found in AI-generated code? The one that made you stop and re-read everything it wrote.