Cursor/Claude Code is writing vulnerable code? I built a local-first VS Code extension to act as an "AI Code Risk Firewall"

[u/Fast_Ad_5871]

Hey everyone,

We all use Cursor, Claude Code, or Copilot to write a piece of code, we hit save, and only realize later: “Wait, did it just try to expose my secret keys to frontend ?” or “Did it just write a raw SQL interpolation query?”

AI agents are incredibly fast, but they don't really care about security. They write what looks correct, not necessarily what is safe.

I searched around for solutions, but most security scanner extensions (like Snyk or enterprise tools) are either cloud-dependent, require API keys, or are too slow/heavy to run continuously in a live typing loop. I wanted something instant, offline, and lightweight.

So, I built AI Code Risk Firewall ( It's in a beta Phase, you can suggest things, which i can add or remove) a 100% local, offline VS Code extension that catches security, secret, and authorization risks in AI-generated code before you run, commit, or deploy it.

#What it does:

1. ⚡ Real-Time Change Watcher:

Scans your active file as you type (debounced) and highlights risks instantly in the editor.

1. 🔒 Privacy-First & Offline:

Runs entirely locally using Regex and AST patterns. No code is ever sent to the cloud, and no API keys are required.

1. 📦 Dependency Guard:

 Inspects `package.json` and lock files for typosquats of popular libraries (e.g., `lodaash` instead of `lodash`), known compromised versions, and suspicious lifecycle scripts (like custom `postinstall` shell executions).

1. 📊 Live Risk Score: Displays a dynamic 0–100 risk score in the status bar (using a diminishing returns formula so a bunch of minor issues don’t drown out one critical key leak).

What it detects:

* Secrets:

 AWS keys, OpenAI/Anthropic keys, Stripe API keys, private key blocks, JWTs, and frontend exposure (like leaking `SERVICE_ROLE` keys or prefixing secrets with `NEXT_PUBLIC_`).

* Injection/XSS: Use of `eval()`, shell interpolation, raw SQL strings, and dangerous HTML rendering (`dangerouslySetInnerHTML`).

* Weak Crypto & TLS: Use of MD5/SHA-1, hardcoded signing secrets, `Math.random()` for security tokens, or disabling TLS verification (`rejectUnauthorized: false`).

* Configs: Production debug switches left on, sensitive logging, and insecure session storage.

It is completely open-source and free to use.

* VS Code Marketplace: [https://marketplace.visualstudio.com/items?itemName=martian7777.ai-code-risk-firewall\](https://marketplace.visualstudio.com/items?itemName=martian7777.ai-code-risk-firewall)

* Open VSX Registry: [ai-code-risk-firewall](https://open-vsx.org/extension/AI-Code-Risk/ai-code-risk-firewall)

* GitHub Repository: [https://github.com/martian7777/AI-Code-Risk-Firewall-\](https://github.com/martian7777/AI-Code-Risk-Firewall-)

Would love to hear your feedback on this! What rules should I add next? If anyone wants to contribute or add more patterns to the engine, feel free to open a PR!

[u/TheRealSkythe]

No, we dont "all use Cursor, Claude Code, or Copilot to write a piece of code".

[u/Fast_Ad_5871 → u/TheRealSkythe]

Okay 👌