Static application security testing
SAST built for code that AI wrote
Prbl is a static application security testing scanner for the code that Cursor, Claude, Copilot, Lovable and Bolt produce. It reads your repo, flags the fifteen patterns those tools get wrong most, explains each one in plain language, and then does the part other scanners stop at: it fixes it.
Why a SAST tool specifically for AI-generated code
AI coding tools optimise for code that works. Insecure code works. So the same few mistakes ship over and over: the key pasted inline to get the feature running, the login page with no authorization check behind it, the query built by string concatenation because that is the shortest thing that returns rows. General-purpose SAST tools can find these, buried in thousands of rules tuned for a different era of code. Prbl finds them first, because they are the whole rule set.
We know they are the whole rule set because we measured it. Across 2,148 AI-built repositories, hardcoded credentials were the top high-severity finding in every group, followed by path traversal, code injection and weak randomness. The data is public.
What it checks
| Rule | What it catches | OWASP |
|---|---|---|
| PRBL-C001 Hardcoded credential | An API key, token or password sitting in source instead of an environment variable | A07 Identification and Authentication Failures |
| PRBL-C002 Hardcoded session or signing secret | A JWT or cookie secret in the code, or a fallback like process.env.SECRET || 'dev' | A07 |
| PRBL-A001 Missing access control | An API route with a sensitive operation and no auth check before it | A01 Broken Access Control |
| PRBL-A002 JWT decoded without verification | jwt.decode() used where jwt.verify() was needed, so any token is trusted | A07 |
| PRBL-T001 Path traversal | User input joined into a filesystem path without normalising it | A01 |
| PRBL-I001 SQL injection | User input concatenated into a query string | A03 Injection |
| PRBL-I002 Command injection | User input passed to exec, spawn or a shell | A03 |
| PRBL-I003 Code injection | User input reaching eval, exec or new Function | A03 |
| PRBL-I004 NoSQL injection | A request body passed straight into a MongoDB query object | A03 |
| PRBL-I005 Prototype pollution | A tainted key used in bracket assignment on an object | A03 |
| PRBL-R001 Weak randomness | Math.random() used for a token, ID or password reset code | A02 Cryptographic Failures |
| PRBL-R002 Timing-unsafe comparison | == used to compare a signature or token instead of a constant-time compare | A02 |
| PRBL-R003 AES-GCM without tag verification | A decipher created without checking the authentication tag length | A02 |
| PRBL-C003 TLS verification disabled | rejectUnauthorized: false or verify=False to make an HTTPS call work | A02 |
| PRBL-P001 Hallucinated package | An import of a package that does not exist on the registry, an open door for slopsquatting | A06 Vulnerable and Outdated Components |
Every rule links to a fix page with the bad pattern, the good pattern, and why AI tools write it. Browse the 53 fix guides.
How it runs
Paste a public repo or a live app URL. Findings in about a minute, with file, line, severity and a plain-language explanation. No account.
The free GitHub Action scans on push and PR and comments findings inline, updated on each push. Turn on fail-on-high to block merges.
Copy the fix prompt into your AI tool, or let the rewriter apply the fix, run the app against a behavioral baseline, and re-scan to confirm.
Prbl vs general-purpose SAST
Snyk Code, Semgrep, SonarQube and CodeQL are excellent at what they were built for: breadth across every language and pattern in a large codebase. This is how Prbl differs, honestly.
| Prbl | General SAST | |
|---|---|---|
| Built for | Code written with AI tools | General-purpose codebases |
| Rule set | 15 rules tuned to what AI tools get wrong, mapped to OWASP | Thousands of rules across every pattern ever catalogued |
| Noise | Every high-severity rule was manually reviewed against real AI-built repos and tightened | Depends heavily on tuning; unfiltered runs are famously noisy |
| After the finding | A copy-paste fix prompt, or the rewriter applies the fix and re-scans | A description and a CWE link; the fix is on you |
| Live app check | Yes, probes a deployed URL for exposed keys, open routes and readable databases | Usually a separate DAST product |
| CI | Free GitHub Action, comments on the PR, optional block on high | Yes, on most plans |
| Languages | Python, JavaScript, TypeScript | Broad |
| Getting started | Paste a repo URL, no account | Sign up, install, configure |
Head-to-head pages: Snyk · Semgrep · SonarQube · CodeQL · Checkmarx · Veracode · the full list
Frequently asked questions
What is SAST?
Static application security testing reads your source code without running it and flags patterns that lead to vulnerabilities: a query built from user input, a secret in the code, a route with no authorization check. It runs early, in the editor or on the pull request, which is why it catches things before they ship. Its weakness is noise: a rule that fires on every string that looks like a key produces hundreds of findings nobody reads.
How is Prbl different from Snyk Code, Semgrep or SonarQube?
Scope and what happens after the finding. Those tools cover every language and every pattern, which is right for a large engineering org. Prbl covers the patterns AI coding tools actually produce, in the languages they mostly produce (Python, JavaScript, TypeScript), and then fixes them: each finding comes with a paste-ready prompt for your AI tool, and the paid rewriter applies the fix and verifies the app still works. Many teams run Prbl alongside a general scanner rather than instead of one.
Does Prbl produce a lot of false positives?
It is built to avoid that. Every high-severity rule was checked by hand against hundreds of real AI-built repositories, and the placeholder values, test fixtures and public-by-design keys those reviews surfaced were turned into exclusions in the scanner. Test files are suppressed for credential and access-control rules. We publish the review data in the open dataset so you can see the exclusions yourself.
Is there a free tier?
The scan is free with no account: paste a public repo URL or a live app URL and get findings in about a minute. The GitHub Action is also free and comments findings on every pull request. Paid plans add the rewriter, private repos, and team features.
Does it run in CI?
Yes. The Prbl GitHub Action runs on every push and pull request, posts findings as inline PR comments, updates them on each push, and can fail the build on a high-severity finding if you turn that on. It is two lines in a workflow file plus an API key stored as a secret.
Which languages does it support?
Python, JavaScript and TypeScript, which is what Cursor, Claude Code, Copilot, Lovable, Bolt and v0 overwhelmingly generate. Repos in other languages are reported as unsupported rather than falsely marked clean.
See what a SAST scan tuned for AI code finds in yours. Public repo or live URL, about a minute, no account.
Scan my repo →