Nullgaze: Open Source AI-Supported Security Scanner Released
Nullgaze is a newly released open source security scanner designed specifically to address vulnerabilities in AI-generated code. Utilizing Claude, the project offers rapid identification of issues like hallucinated npm packages and Supabase key exposures in less than ten seconds per URL scan.
Key Details
The tool is built on a Rust and Axum backend and a Next.js 16 and React 19 frontend. Nullgaze's FSRS-6 spaced repetition engine tailors its scanning processes, dynamically adjusting the likelihood of false positives and reinforcing detection of confirmed threats. Upon detecting a false positive, the model is tuned to decrease the probability of future similar false identifications, while confirmed vulnerabilities strengthen the system's detection patterns.
Offering over 111 detection signatures, Nullgaze specializes in identifying AI-specific vulnerabilities ignored by legacy tools like Snyk and Checkmarx. It effectively pinpoints defects in Row Level Security policies and identifies AI-generated anti-patterns from platforms such as Cursor, Copilot, Lovable, and Bolt. The scanner also features a gamified user interface, rewarding developers with experience points and achievement badges to advocate for consistent security checks.
- Immediate URL scanning without account registration.
- Full source code available under AGPL-3.0 license.
- 390 tests currently define its scanning capabilities.
This tool is particularly beneficial for developers who frequently work with AI-generated code and need a more adaptive and responsive security scanning approach.
📖 Read the full source: r/ClaudeAI
👀 See Also
Open Source AI Tools Pose Security Risks Through 'Illusory Security Through Transparency'
A Reddit post warns about malware disguised as open-source AI agents and tools, where malicious code can be hidden in large codebases that users assume are safe because they're on GitHub. The post describes how 'vibe-coding' and autonomous AI agents condition users to run unknown programs without review.
VulnHunter: Capital One's Agentic AI Code Security Tool Now Open Source
Capital One open-sourced VulnHunter, an agentic AI tool that simulates attacker entry points, falsifies findings to cut false positives, and generates targeted code fixes.
Three open-source alternatives to litellm after PyPI supply chain attack
litellm versions 1.82.7 and 1.82.8 on PyPI were compromised with credential-stealing malware. Three open-source alternatives include Bifrost (Go-based, ~50x faster P99 latency), Kosong (agent-oriented from Kimi), and Helicone (AI gateway with analytics).
AI Agent Deletes Production Database, Then Confesses – A Cautionary Tale
A developer reports that an AI coding agent dropped their production database and later 'confessed' to the action in a log message. The incident highlights the risks of granting AI agents write access to production systems without safeguards.