AI-GENERATED CODE — SHIPS WITH SECRETS

Grep your repo in 30 seconds

AI coding assistants happily write hardcoded API keys, disabled TLS verification, and eval() into your codebase — and they never tell you. Run these 4 copy-paste commands in your repo root right now. Each one finds a class of problem that shows up constantly in AI-generated code. No signup, nothing installed.

The 30-second sweep

Leaked API keys and tokens — the classic AI-coding accident:

grep -rnE "sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|xox[bap]-" . --exclude-dir=.git 2>/dev/null | head -20

Any hits → rotate those keys NOW and move them to environment variables. A committed key is a compromised key.

No hits → good. Still add a pre-commit secret scanner so it stays that way.

Hardcoded passwords and credentials in config-shaped code:

grep -rniE "(password|passwd|api[_-]?key|secret)\s*[:=]\s*['\"][^'\"]{4,}['\"]" . --exclude-dir=.git --exclude-dir=node_modules 2>/dev/null | grep -viE "example|placeholder|your-|xxx" | head -20

Any hits → real credentials in source. Move to a secrets manager or env vars; scrub git history.

Dangerous dynamic execution — AI assistants love eval() shortcuts:

grep -rnE "\beval\(|\bexec\(|os\.system\(|subprocess\.call\(.*shell=True|yaml\.load\(" . --exclude-dir=.git --exclude-dir=node_modules 2>/dev/null | head -20

Any hits on untrusted input → refactor. eval/exec on dynamic data is a standing invitation for code injection.

Disabled security defaults — the "just make it work" leftovers:

grep -rnE "verify\s*=\s*False|_create_unverified_context|StrictHostKeyChecking\s+no|@csrf_exempt" . --exclude-dir=.git --exclude-dir=node_modules 2>/dev/null | head -20

Any hits → each one is a hole an attacker can drive through: MITM-able TLS, unverified SSH, unprotected endpoints.

All four clean → your repo passed the quick sweep. The full scan below goes 50x deeper.

Tip: run these again after every AI-assisted coding session. The patterns above are heuristics — they catch the common cases, not everything.

If you found hits, do this now

Rotate every exposed key and token immediately — assume they're already copied.
Scrub history — git filter-repo or BFG to remove secrets from past commits.
Move secrets to env vars and add a pre-commit hook (e.g. gitleaks) so it can't happen again.
Review the AI's diffs — the commands above are a triage pass, not a full audit.

Deep-scan your code free → Vibe-Code Audit

This page ran 4 heuristic checks. Vibe-Code Audit scans the full attack surface of AI-generated code — prompt-injection surfaces, leaked secrets, insecure defaults, vulnerable dependencies — with fix guidance for every finding.