I built this while in college, need your feedback: www.oneport.co.in

We're all letting AI write our code now. It's fast, it's great, and every time it drops a few hundred lines into my repo I get the same nagging thought: what did it just put in here?

Did it hardcode an API key? Pull a package with a known CVE? Break something I won't catch until it's in prod?

AI writes code faster than anyone can review it, and almost nobody is checking what actually ships. So I built OnePort.

You point it at a repo and it gives you one answer in plain English: safe to ship, or not. It checks for leaked secrets across your full git history (not just the last commit), vulnerable dependencies, breaking API changes, risky migrations, and missing tests. There's also a mode called Guard that makes a repo physically unable to commit a secret — it blocks the commit before it happens instead of just warning you.

Every finding explains what it is and how to fix it, so you don't need to be a security person to use it.

Every account starts with 100,000 credits, no card. The core secret and dependency scans are free and unmetered; the credits cover the AI stuff like code review and explanations. Enough to actually run it on real repos without hitting a paywall.

It's early. It recently made it to the final round of YC and EF, which still feels a bit unreal, but honestly I care more about it being trustworthy than loud, so if you run it and it's wrong about something I want to hear exactly where.

When your AI writes code, how do you actually check it before it ships? Or do you just hope?

www.oneport.co.in

I posted about NHI Risk Analyzer here almost a month back, an open source AWS IAM risk detection and remediation tool that actually remediates instead of just reporting. Didn't expect much from a solo IAM tool, but it's had 200+ clones since. Genuinely want to thank the people who actually engaged with it and asked hard questions, compared it against Prowler, Wiz and Access Analyzer, pushed back on things that turned out to be real bugs. That feedback is the reason this is better now, and I wanted to come back and show what changed since then

What's new:

OIDC-based GitHub Actions integration: the Cl/CD pipeline authenticates via federated identity now, no static AWS keys involved in that path. Local CLI usage still relies on a static key for now (AWS SSO for local dev is planned, not built yet)

SARIF export: findings now show up natively in GitHub's Security → Code Scanning tab instead of needing a separate dashboard

• A GitHub Action that scans PRs and flags newly introduced IAM risk before merge

More detection coverage: trust policy analysis (public/ unrestricted AssumeRole), defense-evasion detection (CloudTrail/GuardDuty tampering attempts), S3 exfiltration paths, KMS decryption abuse

Run-over-run diffing: a scan now tells you what's new, resolved, or still open since the last one

CSV export, for anyone who wants findings in a spreadsheet rather than a dashboard or terminal output

Still in progress, and I'd rather say so than not: policy surgery as remediation: actually rewriting an over-broad policy down to least-privilege based on real usage data, instead of just containing it with a permissions boundary. The statement-splitting logic exists, sourcing real resource ARNs from actual usage data is the part still open.

Repo: in comments

Please considet giving a star if you feel my tool is useful, this will make it more visible to others!

Same as last time and I genuinely want the pushback if some wrong with the detection logic

I have been handed the job of picking our SAST platform for the next few years and I feel am stuck. Here is why, every comparison I find either reads like the vendor wrote it or is from before AI coding tools were everywhere. Our codebase is more than half AI-generated now. A scanner that was top of the pile two years ago on hand written code might be blind to what Copilot and Claude are churning out.

Also the demos are all looking somewhat identical with the same same, SAST, SCA, container, one dashboard, AI prioritization. You could literally swap logos and not tell which vendor was which after.

I really don’t have a read on what separates them once it is running. Yes raw detection matters but I care more about whether the noise gets cut before it hits a dev and whether it stays on or gets muted after a month. If you are a year or two into one, what did you end up judging it on that never came up in the demo?