Nullgaze: Open Source AI-Supported Security Scanner Released
Nullgaze is a newly released open source security scanner designed specifically to address vulnerabilities in AI-generated code. Utilizing Claude, the project offers rapid identification of issues like hallucinated npm packages and Supabase key exposures in less than ten seconds per URL scan.
Key Details
The tool is built on a Rust and Axum backend and a Next.js 16 and React 19 frontend. Nullgaze's FSRS-6 spaced repetition engine tailors its scanning processes, dynamically adjusting the likelihood of false positives and reinforcing detection of confirmed threats. Upon detecting a false positive, the model is tuned to decrease the probability of future similar false identifications, while confirmed vulnerabilities strengthen the system's detection patterns.
Offering over 111 detection signatures, Nullgaze specializes in identifying AI-specific vulnerabilities ignored by legacy tools like Snyk and Checkmarx. It effectively pinpoints defects in Row Level Security policies and identifies AI-generated anti-patterns from platforms such as Cursor, Copilot, Lovable, and Bolt. The scanner also features a gamified user interface, rewarding developers with experience points and achievement badges to advocate for consistent security checks.
- Immediate URL scanning without account registration.
- Full source code available under AGPL-3.0 license.
- 390 tests currently define its scanning capabilities.
This tool is particularly beneficial for developers who frequently work with AI-generated code and need a more adaptive and responsive security scanning approach.
📖 Read the full source: r/ClaudeAI
👀 See Also
Blindfold: A Plugin That Prevents Claude Code from Reading Your .env Files
Blindfold is a new plugin that prevents Claude Code from accessing actual secret values in .env files by keeping them in the OS keychain and using placeholders like {{STRIPE_KEY}}, with hooks that block direct access attempts.
Malicious PyTorch Lightning Package Steals Credentials and Worms npm Packages
PyPI package 'lightning' versions 2.6.2 and 2.6.3 contain Shai-Hulud themed malware that steals credentials, tokens, and cloud secrets, and spreads to npm packages via injected JavaScript payloads.
Claude Code Identifies Malware Backdoor in GitHub Repo During Technical Audit
A developer used Claude Code to audit a GitHub repository before execution and discovered a remote code execution backdoor in src/server/routes/auth.js that would have compromised their machine. The prompt requested a technical due diligence audit checking project completeness, AI/ML layer, database, authentication, backend services, frontend, code quality, and effort estimate.
OpenClaw Security Audit Command Prompts Plain-English Vulnerability Reports
A Reddit user shared a prompt for the OpenClaw CLI that runs a deep security audit and outputs findings in plain English, specifying what's exposed, severity scores, and exact config fixes.