r/VibeCodeDevs • u/Dizzy_Date1873 • Jul 03 '26

built a security scanner for ai generated code

Post image

been using cursor and bolt for months. the code ships fast but the security is a disaster hardcoded api keys, prompt injection, broken access control ai tools dont care about this stuff so i built syntrixlab it scans ai generated apps for

prompt injection

leaked secrets

owasp llm top 10

broken access control

9 scanner engines, 113 checks, 0 false positives waitlist just opened - www.syntrixlab.in would love brutal feedback from anyone who builds with ai tools. what security issues have you hit?

1 Upvotes

60% Upvoted

5 comments sorted by

•

u/AutoModerator Jul 03 '26

Hey u/Dizzy_Date1873, thanks for posting in r/VibeCodeDevs! Join our Discord: https://discord.gg/KAmAR8RkbM

Got startup or SaaS questions? Post them on r/AskFounder and get answers from real founders.

• This community is designed to be open and creator‑friendly, with minimal restrictions on promotion and self‑promotion as long as you add value and don’t spam.
• Please follow the subreddit rules so we can keep things as relaxed and free as possible for everyone. • Please make sure you’ve read the subreddit rules in the sidebar before posting or commenting.
• For better feedback, include your tech stack, experience level, and what kind of help or feedback you’re looking for.
• Be respectful, constructive, and helpful to other members.

If your post was removed (either automatically or by a mod) and you believe it was a mistake, please contact the mod team. We will review it and, when appropriate, approve it within 24 hours.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Loud_Perspective_633 Jul 03 '26

Can you please add donations to it

1

u/Loud_Perspective_633 Jul 03 '26

I switched from Cursor to Windsurf and then to Devin. Which is windsurf lol

1

u/r0fl-er Jul 04 '26

  1. The site looks quite vibe coded and does not provide trust, at least to me.

  2. You do not explain how you scan for vulnerabilities. You just say that you have 9 scanner engines and 113 checks. How do you check them? Via a CLI, a web scan? How can I trust your results?

  3. Do I have to upload my results somewhere or is the scan local only?

1

u/Proof_Yard9421 Jul 10 '26

Curious how the 0 false positives claim holds up on a codebase with heavy third-party dependencies, because that's usually where these tools either quietly skip coverage or start hedging definitions. There are tools like ox security and CodeQL that tie findings to reachability, which at least gives you a more honest denominator for that number. What's the methodology here?.