A vibe code scanner reviews AI-written code for security flaws. Cybersecurity news shows AI-generated pull requests need automated review. Compare 6 scanners here.
Cybersecurity news keeps finding the same problem: AI-written code ships vulnerabilities at machine speed, and human review cannot keep up. These 6 scanners review AI-generated pull requests for injection flaws, hardcoded secrets, and insecure patterns. No scanner catches everything; the honest use is layered: scanner first, human second, on high-risk changes. Compare detection rates and false positives here, then trial two finalists on your own repos.
A vibe code scanner is a security tool that reviews AI-generated ('vibe-coded') code for vulnerabilities — injection flaws, hardcoded secrets, insecure patterns — that humans miss when shipping at AI speed.
Veracode's research keeps finding the same thing: nearly half of AI-generated code ships with a vulnerability. The good news is a new crop of open-source AI code security scanners is built specifically for the code AI writes. We checked each project's repo live on Oct 16, 2026 and wrote down what's real, what's missing, and which one fits you. No sponsored placements — every claim below is verifiable.
| Tool | Type | Vibe-code focus | AI triage | Maturity | License |
|---|---|---|---|---|---|
| isitsecure | SAST + DAST | Built for vibe coders | Yes — LLM triage + FP adjudication (API key) | Active — 72 releases | Apache-2.0 |
| vibescan | SAST (DAST planned) | Vibe Top 10 taxonomy | Planned — not yet wired | Pre-release — build from source | MIT |
| AXguard | SAST (deterministic) | Pre-ship gate for AI apps | No — deterministic rules by design | Active | Open-source (see repo) |
| Cloudflare security-audit-skill | Agent-led audit | Works on any codebase | Yes — skeptic agents refute findings | Active | MIT |
| Semgrep | SAST | Generic | No | Mature | LGPL-2.1 (OSS engine) |
| OWASP ZAP | DAST | Generic | No | Mature | Apache-2.0 |
github.com/jaurakunal/isitsecure — Apache-2.0 · 43 stars · 331 commits · 72 releases (verified Oct 16, 2026)
What it is: one command that runs 42–45 rule-based scanners against a web app — static analysis on your code, dynamic probes against the running app, and an LLM layer that reviews findings and generates fixes. Its DAST scanners are purpose-built with differential oracles (comparing baseline vs. injected responses) rather than wrapping ZAP, and SAST findings automatically generate targeted DAST tests to confirm exploitability.
Strengths: the only tool here with real custom DAST and AI false-positive adjudication working today; actively released; ships a deliberately vulnerable test app (VibeTasks) to try it on; MCP support for AI coding tools.
Limits: LLM features need an Anthropic or Google API key (roughly $5–15 per full scan); web-app focused (JS/TS, Python, Java/Kotlin, Go).
Best for: vibe coders who want the most complete free scan of a web app right now.
github.com/Armur-Ai/vibescan — MIT · 92 stars · 146 commits · 0 releases, pre-release (verified Oct 16, 2026)
What it is: orchestrates 30+ established open-source scanners (Semgrep, gosec, Bandit, ESLint, Trivy, Gitleaks, Slither, Brakeman and more) behind one command, normalizes severities, maps findings to CWEs, and organizes them around a "Vibe Top 10" — the failure modes that show up again and again in AI-generated apps. Its own status docs are admirably honest about what works and what doesn't.
Strengths: broadest scanner coverage of any tool here; vibe-specific taxonomy; SARIF/JSON/HTML reports; refreshingly honest documentation.
Limits: pre-release — build from source (Docker + Go); the headline extras (MCP server, AI fixes, DAST/exploit simulation) are implemented as packages but not yet wired to the CLI. Don't pip install vibescan — that PyPI name belongs to an unrelated project (their README warns about this).
Best for: tinkerers who want maximum scanner coverage and don't mind building from source.
github.com/awarexone/AXguard — open-source (check repo for license) · actively maintained (verified Oct 16, 2026)
What it is: a pre-ship security gate for vibe-coded apps: 47 deterministic rules across 16 JSON packs plus five dataflow hunters, shipped as a CLI, an agent plugin (Claude Code, Cursor, OpenCode, Codex), an MCP server, and a local API. Detection is deliberately deterministic — no LLM in the detection path — with triage, attack-path chaining, and confidence scoring layered on top.
Strengths: deterministic means reproducible and no token costs; deepest agent integration of any tool here (31 slash commands, 38 skills); runs entirely on your machine.
Limits: static analysis only — no dynamic testing; 47 rules is a smaller net than orchestrators like vibescan.
Best for: developers who want a fast, deterministic gate inside their AI coding agent before every publish.
github.com/cloudflare/security-audit-skill — MIT (verified Oct 16, 2026)
What it is: not a scanner but a methodology — a Claude Code skill that orchestrates isolated agents through six phases: reconnaissance, coverage-led hunting, candidate validation, structured output, independent record verification, and target-neutral reporting. A "skeptic agent" adversarially tries to refute every finding, so only reproducible ones survive. Findings land as machine-readable, schema-checked records.
Strengths: the most rigorous false-positive control here — skeptic agents do what most scanners can't; free; from a team that runs internet-scale security.
Limits: requires Claude Code and an agent workflow — it's not a standalone scanner you point at a repo; review depth depends on the model running it.
Best for: Claude Code users who want the deepest AI-led review, not just pattern matching.
github.com/semgrep/semgrep — open-source, LGPL-2.1 (OSS engine)
What it is: the open-source static analysis engine half this list is built on. Fast, CI-friendly, with a huge community rule registry covering dozens of languages.
Strengths: mature, fast, enormous rule ecosystem; the default SAST answer for a reason.
Limits: generic — not vibe-specific; noisy out of the box without tuning; advanced taint tracking takes setup.
Best for: anyone who needs a dependable SAST gate in CI today.
github.com/zaproxy/zaproxy — Apache-2.0
What it is: the OWASP flagship dynamic scanner — spiders your running app and attacks it like an outsider, finding the runtime flaws static analysis can't see.
Strengths: the standard free DAST; spider + AJAX spider + API scanning; huge community.
Limits: needs a running app; can be noisy; no AI triage — you read the findings.
Best for: proving what's actually exploitable in a deployed app.
Pick one answer per question. Your recommendation updates live.
The picker scores your answers against each tool's strengths — change any answer and the recommendation updates.
Reality check: no scanner catches everything. Pair any of these with the scan-hygiene basics — secret scanning in CI, parameterized queries, no eval() — covered in our vibe-code security check.
There is no single winner — it depends on your setup. isitsecure is the most complete all-rounder today (real SAST + custom DAST + LLM false-positive triage, actively released). vibescan aggregates the most scanners (30+) but is pre-release. AXguard is the best deterministic in-agent pre-ship gate. Cloudflare's security-audit-skill gives the most rigorous AI-led review inside Claude Code. Semgrep and OWASP ZAP remain the best standalone SAST and DAST workhorses.
SAST (Static Application Security Testing) analyzes source code without running it — fast and early, but noisy. DAST (Dynamic Application Security Testing) probes the running application like an attacker — real proof of exploitability, but only after the app runs. They catch different bug classes, so mature teams use both.
No. Scanners catch known-bad patterns and common misconfigurations at scale, which is exactly what vibe-coded apps need first. They do not replace human pentesters for business-logic flaws, chained exploits, or novel attack paths. Think of scanners as the seatbelt, not the driver.
The tools listed are open-source and free to run. The only costs are your compute time and, where AI features are used, LLM API tokens (isitsecure estimates roughly $5–15 for a full AI-assisted scan). Always check each project's repo for its current license.
Run a static-analysis (SAST) scanner over the repo — open-source options include Semgrep and vibe-code-focused AI code security scanners — plus a secrets scan for hardcoded API keys, then a dynamic (DAST) scan against the running app. No scanner replaces a human review of authentication, data handling, and business logic.
Vibe coding security is the practice of checking AI-generated code for the flaws models commonly introduce: hardcoded secrets, injection flaws, cross-site scripting, disabled TLS verification, and insecure defaults. Research (Veracode's 2025 GenAI Code Security Report) found 45% of AI-generated code shipped a real vulnerability.
Open-source AI code security scanners include vibescan, isitsecure, and AXguard, plus Cloudflare's security-audit-skill and general tools like Semgrep for static analysis and OWASP ZAP for dynamic testing. The right pick depends on your stack: SAST for code, DAST for running apps, secrets scanners for leaked keys.