The Security Stack for AI-Generated Code

Most teams building with AI coding tools have no security tooling at all. They’re shipping code that was generated in minutes, reviewed in seconds, and deployed without any automated checks.

Here’s what you actually need, broken down by when it runs.

Pre-Commit Tools

These catch issues before code reaches your repository.

1. Gitleaks

Finds secrets in your code before you commit them.

1
2

brew install gitleaks
gitleaks detect --source . --verbose

Why it matters for AI code: AI coding tools love hardcoding secrets during development. Gitleaks catches API keys, database credentials, and tokens before they hit git history.

Cost: Free and open source.

2. Pre-commit Framework

Orchestrates multiple checks on every commit.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
  - repo: https://github.com/returntocorp/semgrep
    rev: v1.45.0
    hooks:
      - id: semgrep
        args: ['--config', 'auto']

Cost: Free.

3. Semgrep

Static analysis that you can customize for AI code patterns.

Write custom rules for your specific AI tool patterns:

1
2
3
4
5
6

rules:
  - id: lovable-supabase-auth-bypass
    patterns:
      - pattern: supabase.from($TABLE).select(...)
      - pattern-not: supabase.from($TABLE).select(...).eq('user_id', ...)
    message: "Missing user_id filter - potential auth bypass"

Cost: Free for individuals and small teams.

CI/CD Tools

These run on every pull request.

4. Snyk

The most mature vulnerability scanner for dependencies and code.

1
2
3
4
5

# GitHub Actions
- name: Snyk Security Scan
  uses: snyk/actions@master
  with:
    command: test

Strength: Excellent dependency vulnerability database. Good at catching known CVEs in packages AI tools suggest.

Cost: Free tier available, paid plans from $25/month.

5. GitHub Advanced Security

If you’re on GitHub Enterprise, enable this immediately.

• Secret scanning (catches credentials in PRs)
• CodeQL analysis (finds vulnerability patterns)
• Dependency review (blocks vulnerable packages)

Cost: Included in GitHub Enterprise.

6. SonarQube/SonarCloud

Code quality and security analysis with good AI code coverage.

Strength: Catches code smells that indicate security issues—complex auth logic, duplicated validation code, missing error handling.

Cost: SonarCloud free for public repos, SonarQube Community Edition free.

7. Trivy

Container and infrastructure scanning.

1
2

trivy image your-app:latest
trivy fs --security-checks vuln,secret,config .

Why it matters: If you’re deploying AI-generated Dockerfiles, they often have security misconfigurations. Trivy catches running as root, exposed ports, and vulnerable base images.

Cost: Free and open source.

Runtime Protection

These monitor your application in production.

8. Datadog Application Security

Runtime application self-protection (RASP) that catches attacks in production.

Strength: Sees actual attack attempts. Blocks exploitation of vulnerabilities you missed in testing.

Cost: Starts at $31/host/month.

9. Cloudflare WAF

Web application firewall that blocks common attacks.

AI code benefit: Blocks SQL injection, XSS, and other attacks that AI-generated code is vulnerable to. Buys you time to fix issues properly.

Cost: Free tier available, Pro from $20/month.

10. Sentry

Error tracking that often catches security issues.

1
2
3
4
5
6
7

Sentry.init({
  dsn: "your-dsn",
  beforeSend(event) {
    // Don't send sensitive data
    return event;
  }
});

Security use: Unusual error spikes often indicate attack attempts. Watch for auth failures, validation errors, and unexpected exceptions.

Cost: Free tier with 5K errors/month.

AI-Specific Tools

11. VibeEval

Purpose-built for AI-generated code security. Runs 200+ checks designed for patterns in Cursor, Lovable, Bolt, and Claude Code output.

What it catches:

• Auth bypass patterns specific to Supabase + Lovable
• Prompt injection in LLM-powered features
• Missing rate limiting on AI-generated APIs
• IDOR vulnerabilities in AI-generated CRUD operations

Cost: Free tier for 3 projects.

12. LLM Guard

For apps with AI/LLM features, protects against prompt injection.

1
2
3
4
5

from llm_guard import scan_prompt, scan_output

cleaned_prompt = scan_prompt(user_input)
response = llm.generate(cleaned_prompt)
cleaned_response = scan_output(response)

Cost: Open source.

The Minimum Viable Stack

If you can only set up three tools, use these:

1. Gitleaks — Stop committing secrets
2. Snyk — Catch vulnerable dependencies
3. Cloudflare WAF — Block attacks in production

This takes an hour to set up and catches the most exploitable issues.

The Complete Stack

For production applications handling user data:

FAQ

Conclusion