▲CodeCordon

31 rules purpose-built for AI-generated code

Find the security bugs your AI builder left behind

Upload a zip or paste a public GitHub URL. CodeCordon scans for hardcoded secrets, missing auth, injection risks, prompt-injection patterns, and unsafe config, then shows the exact file, line, and fix.

No account required. Public repositories only. Preview links expire after 24 hours.

Create a free accountHow it works

Honest scanner, not a certification. No known-pattern issues does not mean secure.

Demo scan result

v0-generated task board

F · 28/1009 findings

What CodeCordon caught

Secrets exposed2 critical
Auth and injection3 high
LLM and config risks4 medium

CI-ready JSON report

Pro teams can gate builds on critical findings through the REST API.

criticalSEC001Hardcoded provider key

src/lib/ai.ts:14

apiKey: "sk-proj-...REDACTED"
highAUTH001Mutating route has no auth check

app/api/jobs/route.ts:7

export async function POST(req) {
mediumLLM002User input interpolated into system prompt

src/agent/prompt.ts:22

content: `You are admin for ${userRole}`
Static analysis only: deterministic rules, real file and line numbers.
Secrets are redacted before they appear in findings or reports.
Clean scans say "no known-pattern issues found," not "secure."

Coverage

Broad by design. Honest about depth.

CodeCordon scans major AI-app stacks without pretending every language receives identical analysis. Every result should be read in the context of the rules that apply.

Read the security and data policy

Deepest coverage

JavaScript · TypeScript · Python

Code-aware checks for common web, API, auth, injection, and LLM patterns.

Pattern coverage

Ruby · PHP · Go · Java · Kotlin · C# · Rust · Swift · Dart · Vue · Svelte

Secrets plus selected high-signal checks for dynamic SQL, shell execution, password hashing, TLS, and deserialization.

Config and infrastructure

JSON · YAML · TOML · SQL · Shell · Prisma · GraphQL · Docker

Credential exposure, unsafe settings, database rules, and supply-chain hazards.

Secrets & Keys

Hardcoded OpenAI/Anthropic/AWS keys, committed .env files, secrets leaking into client bundles.

Injection

SQL built with string interpolation, shell commands from user input, eval, path traversal.

Authentication

API routes that mutate data with no auth check, TODO-auth stubs, plaintext password storage.

AI/LLM Security

Prompt injection, LLM keys in browser code, model output rendered as HTML or piped into a shell.

Web Security

Wildcard CORS, insecure cookies, XSS via innerHTML, forged JWTs, mass-assignment.

Configuration

Wide-open Firebase/Supabase rules, debug mode in production, IDOR, curl-pipe-sh installs.

How it works

1 · Point

Upload a zip of your project or paste a public GitHub URL. node_modules and build output are skipped automatically.

2 · Scan

Every file runs through the full rule set in seconds. Findings are deduplicated, redacted, and scored into an A–F security grade.

3 · Fix

Each finding shows the exact file and line, why it's dangerous, and the concrete fix. Export Markdown/JSON reports or gate CI with the REST API.

One-command scan

Preview public repos free. Gate local code with Pro.

Paste a public GitHub URL into one terminal command. No account is required, and the preview remains available for 24 hours. Upgrade when you need local-folder scans, saved team workflows, API keys, and pull-request enforcement.

Local archives are assembled in memory. Dependencies, build output, lockfiles, binaries, and oversized files are excluded before upload.

See the 60-second guideAdd the GitHub Action
Copy, paste, scan
npx --yes --package=https://github.com/fj8b85t9g6-blip/codecordon-cli/releases/download/v0.3.0/codecordon-0.3.0.tgz codecordon scan https://github.com/owner/repo
  1. 1. Replace owner/repo with any public GitHub repository.
  2. 2. Run it in an interactive terminal—no login or API key.
  3. 3. Inspect the result and 24-hour web preview.
Pro powers local and CI scans · public GitHub previews remain free with no account

Verified in a real repository

FieldBase: 15 high findings reviewed, eleven XSS paths fixed

A reproduced scan moved from 38/F to 100/A after two scoped commits. The case study includes the intermediate result, commit links, verification method, and the limits of what the score means.

Read the evidence

Pricing

Start with the product, not a sales call

Run real scans free. Upgrade when you need CI enforcement and higher limits.

Free

$0

No credit card required

  • 5 projects
  • 20 scans per day
  • Zip and public GitHub scanning
  • Markdown and JSON reports
Create free account

Pro

For shipping teams

$19/month

Manage or cancel through Stripe

  • 100 projects
  • 500 scans per day
  • CI API and API keys
  • Fail builds on critical findings
Start free, upgrade later

Questions

Before you upload code

Do you keep my source code?

CodeCordon processes the uploaded zip or public GitHub download for the scan and does not intentionally retain the full archive or repository. It stores scan metadata, findings, and the source-line snippets attached to findings until you delete the project.

Does an A grade mean my app is secure?

No. It means none of the applicable known-pattern rules produced enough findings to lower the score. CodeCordon cannot prove the absence of logic flaws, novel vulnerabilities, or runtime issues.

Can I scan a private GitHub repository?

Not yet. The web scanner accepts zip uploads and public GitHub URLs, so private code can be downloaded locally and uploaded as a zip. Repository credentials are never requested.

What does Pro add?

Pro raises limits to 100 projects and 500 scans per day, unlocks API keys, and lets CI pipelines upload a build and fail on critical findings.

Your AI builder shipped fast. Check what it missed.

Run a deterministic scan, inspect every finding in context, and fix the dangerous patterns before users find them first.

Scan your first project free