Code security review
A pre-ship security pass for small teams: secrets and dangerous patterns are scanned locally, secrets are masked before the model sees anything, and every confirmed finding ships with a severity, a CWE class and a fix.
About this tool
Small teams ship without a security pass because a real audit is slow and expensive, so the classic mistakes — hard-coded secrets, SQL built by string concatenation, eval on user input — go out the door. This review runs a fixed local rule library over your code first, with line numbers, so the known hard failures cannot be missed.
Anything that looks like a secret is masked on your device before the model sees a single line. The model then judges each local finding in context — real problem or false positive — with a severity, a CWE class and a fix, and can add findings of its own; local rule hits are always listed, never silently dropped. Export the report as Markdown straight into your pull request.
How to use Code security review
- Add your provider API key in the key panel.
- Paste code or upload code files — secrets and dangerous patterns are scanned locally first.
- Detected secrets are masked on your device before anything is sent to the model.
- Review each finding with its severity, CWE class and fix, then export the report for your PR.
Keep the original files and inspect the exported result before publishing or sharing it.
Frequently asked questions
Are my API keys in the code sent to the model?
No. Detected secrets (cloud keys, tokens, private keys, hard-coded passwords) are replaced with a redaction marker on your device; the model only ever sees the masked code.
What does the local scan catch?
Hard-coded secrets plus a fixed rule library: eval and new Function, innerHTML/document.write sinks, shell-command construction, pickle on untrusted data, SQL built by concatenation or template interpolation, weak hashes and disabled TLS verification.
Can the model override the local findings?
It judges each local finding (real problem or false positive) with the surrounding context and can add findings of its own, but the local rule hits are always listed — nothing is silently dropped.
Where does my code go?
The masked code is sent only to the AI provider behind your own key, directly from your browser.
Related tools
- AI chat — Chat with OpenAI, Claude or Gemini using your own API key. Your key stays in your browser; requests go straight to the provider.
- AI summarizer — Summarize long text with your own OpenAI, Claude or Gemini API key. Brief, detailed or bullet-point summaries, all in your browser.
- AI translator — Translate text between 30 languages with your own OpenAI, Claude or Gemini API key. Private by design: key and text stay with you and the provider.
- AI writing assistant — Improve, expand, shorten or re-tone your writing with your own API key. Six editing modes, direct browser-to-provider calls.
- AI code explainer — Paste code and get a plain-English explanation using your own OpenAI, Claude or Gemini API key. Language auto-detect included.
- AI PDF chat — Upload a PDF and ask questions about it. The PDF is parsed in your browser; only the extracted text and your question go to your chosen AI provider.
- AI image analyzer — Upload an image and let AI describe it, extract text (OCR), or identify objects. Uses vision models from OpenAI, Claude or Gemini with your own key.
- AI voice generator — Turn text into natural-sounding speech with OpenAI TTS. Six voices, speed control, play in the browser and download MP3.
- AI data analyst — Upload a CSV and ask questions in plain English. The file is parsed locally; the AI sees only a schema summary and sample rows.
- AI spend analyzer — Turn your AI provider usage export into an independent cost receipt: per-model and per-day breakdowns, spike alerts and a monthly projection. Runs 100% in your browser — your billing data is never uploaded.