Code Validator

code-validator

[](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) [](#) [](#)

**What is code-validator?** A static security scanner purpose-built for code produced by AI assistants (Claude, ChatGPT, GitHub Copilot, Cursor). Detects hardcoded credentials, CORS misconfigurations, SQL injection patterns, and dependency CVEs — in under 1 second per file, fully offline, with zero external API calls.

**Why this exists:** AI assistants frequently emit code that *looks* correct but contains subtle security defects — hardcoded API keys in examples, `allow_origins=["*"]` with `allow_credentials=True`, string-concatenated SQL. `code-validator` is the lightweight CI gate that catches these *before* they reach `main`.

🎯 Use case	Block insecure AI-generated code at PR time
⚡ Speed	<1s per file, --git-diff mode scans only changed files
🔒 Privacy	100% offline. No code leaves your machine. Only dependency: pydantic
🧪 Detection rules	20 rules across security, quality, and dependency layers (SEC001–SEC013 excluding SEC007, QUAL001–QUAL002, DEP001–DEP006)
📦 Install	pip install -r requirements.txt — done

---

Features

Security Scanning

• Hardcoded credentials: API keys (OpenAI, Anthropic, Google, GitHub tokens), passwords, database URLs, Django/Flask SECRET_KEY, AWS access keys, and embedded PEM private keys
• Dangerous CORS configurations: wildcard origins, and wildcard origins combined with allow_credentials=True
• SQL injection patterns: f-string interpolation, + concatenation, str.format(), and % operator
• Command injection: os.system / os.popen / `subproce