Sourced: Veracode found 45% of AI code carries an OWASP Top 10 flaw, CodeRabbit measured 1.7x more issues per PR, and ~20% of AI-suggested packages don't exist.

Vibe coding ships fast. The O(N²) loop, the hardcoded secret, the hallucinated import — they ship too. BrassCoders catches all four bug classes in 30 seconds.

All 12 scanners are free in the OSS core; Paid adds ranking, not detection. The honest line on when free is enough and when $12/dev/month pays off.

The OSS core finds everything; the Paid plan ranks it. In one published case study, BrassCoders Paid took a scan from 2,470 raw findings to 217 after heuristic reduction to 22 after enrichment, for $12 per developer per month.

BrassCoders runs a Babel-based JavaScript and TypeScript scanner on .js and .ts files automatically, catching secrets and security patterns alongside Python.

AI assistants drop real-looking names, emails, and SSNs into fixtures and stubs. BrassCoders flags PII-shaped strings in source before they reach a shared repo.

Veracode found 1 in 5 AI-generated SQL snippets still vulnerable, and a 2022 study put Copilot's SQL injection rate at 37%. The numbers, and how to catch it.

AI test generators hit 80% coverage on toy benchmarks and under 2% on real code. Coverage counts execution, not verification. The numbers, and the real check.

BrassCoders bundles Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, and detect-secrets into one scan: one install, one ranked YAML, no six-tool config.

AI assistants hardcode realistic-looking API keys into example code. BrassCoders bundles detect-secrets and adds custom formats, covering 20+ credential types.

A real scan of OWASP's intentionally-vulnerable PyGoat app: BrassCoders now catches all 11 documented findings, including 4 gaps closed since the May baseline.

AI assistants write O(N²) loops that pass every test and crawl at scale. BrassCoders flags all four patterns where Bandit and Semgrep catch none.

AI coding assistants confidently generate imports of packages that don't exist on PyPI or npm. The pattern is documented, the supply-chain risk is real, and the detection is straightforward — here is how it works.

BrassCoders scans run entirely on your machine by default. The Paid plan adds one network call to our gateway with already-redacted findings, never raw source code. Here is every byte that leaves your machine.

A worked example of BrassCoders plus an AI assistant doing real PR review work. Scan locally, hand the ranked output to Claude Code or Cursor, walk each finding to a diff. Total reviewer time stays roughly constant regardless of diff size.

AI coding assistants embed credentials in generated config files, example scripts, and test fixtures more often than developers expect. The detection pattern is entropy plus format matching — here is what BrassCoders scans for and why.

Catastrophic backtracking turns one crafted input into a denial-of-service attack: real npm advisories and how to catch it before it ships.

PyYAML's yaml.load carried a CVSS 9.8 CVE. PyTorch's torch.load carried one at 9.3, in 2025, in a flag documented as safe. Here is the actual track record.

AI coding assistants can reproduce license-encumbered training data. Here is what the memorization research, GitHub's own data, and an active lawsuit say.

OWASP ranks broken access control the top web risk and BOLA the top API risk. Real prevalence and attack data, and what BrassCoders can honestly flag.

BrassCoders Paid is now generally available. $12/dev/month adds AI-powered semantic dedup, cluster sizing, and rank-by-relevance against your project signature. The OSS core stays free forever.

The full BrassCoders CLI is open source on GitHub under Apache 2.0. 12 scanners, source-auditable detection, contributions welcome. Repo at CopperSunDev/brasscoders.

AI-generated code drove a 2.74× CVE increase in Q1 2026 — from 6 AI-attributed CVEs in January to 35 in March alone. A reading of what the data says about where deterministic detection needs to go.

BrassCoders closes the loop on AI-written bugs: scan for the finding, hand it to your assistant for a patch, then re-scan to confirm the fix deterministically.

BrassCoders ran a first-party probe: 96 package names a frontier AI model suggested for Python tasks, checked live against PyPI. 95 existed; 1 didn't.

A dated, sourced snapshot of AI-generated-code defect and security rates for Q3 2026: 45% OWASP flaws, 1.7x issues per PR, 19.7% phantom packages. Refreshed quarterly.

Wire a Claude Code hook to run brasscoders scan on every edit, so .brass/ai_instructions.yaml stays fresh and the assistant reads findings without copy-paste.

A 2025 benchmark puts LLM code-review recall at 0.78 to 0.88, yet the models mislocate findings and vary run to run — the numbers on why it's a weak gate.

AI coding assistants reason within a single file's context window and miss bugs whose taint flows across three or more files. The category that ships past AI-assisted review.

AI code review and deterministic static analysis are complementary layers, not competitors. The math of running both, the hand-off prompt, and when replacing one with the other is wrong.

A static-analysis report with 1,500 findings is functionally a report with zero findings — nobody reads it. The bottleneck is ranking, not detection.

Auditors do not accept stochastic scanner output. Deterministic, reproducible, citation-ready YAML — the audit posture an AI-augmented engineering team needs by 2026.

A new guide covers how to run BrassCoders on every commit — a CI step on push or a git pre-commit hook — and why there's no automatic watch mode. BrassCoders is a command-line scanner you invoke, not a background daemon.

BrassCoders is one of five AI tools from Copper Sun Content and Creative. Here are the other four, and why an engineer might actually want them.

Bandit caught 6 of 12 planted bugs in BrassCoders's AI-coder benchmark — and 0 of the 4 performance anti-patterns AI coding assistants introduce most often. Here's why, and what to add alongside it.

AI assistants invent package names that don't exist; one study found 19.7%. BrassCoders flags every unresolvable import before the install runs.

A real before-and-after: BrassCoders's SecretsScanner finds a hardcoded HMAC signing key in a corpus Python file. The environment variable fix, the re-scan, and why detect-secrets catches this where Bandit alone misses some cases.

SQL injection: caught. Missing auth on a route: not caught. BrassCoders maps the precise boundary between what static analysis detects deterministically and what requires an AI assistant's context.

A walkthrough of the four AI-coder performance anti-patterns BrassCoders catches that Bandit, Pylint, and a frontier model reviewer all miss: O(N²) string concat, insert-at-zero loops, triple-nested joins, and unbounded polls.

Before-and-after walkthrough: BrassCoders finds SQL injection in a corpus Flask endpoint, the parameterized fix, and what the re-scan shows — including the one Semgrep taint finding that remains.

BrassCoders flags MD5 in a file-deduplication script as a CRITICAL security finding. The pattern match is correct — the context makes it a false positive. Here's the before scan, the .brassignore entry, and the after scan.

Detection time, remediation effort, credential rotation, and incident response — framed in engineering hours, not dollar amounts. And what catching it at commit time costs instead.

Yes — via a dedicated Babel-based JavaScript/TypeScript scanner and Semgrep. Here's exactly what it catches and where the gap is versus the Python scanner.

Evaluating an AI coding assistant for your team? Two separate surfaces require two separate question sets. Here's the checklist for both.

Partially. BrassCoders catches structural indicators — threading.Thread without locks, shared mutable state in async functions — but not asyncio races that leave no structural marker.

Step-by-step: install BrassCoders, run the scan, read the .brass/ai_instructions.yaml output, and understand what to do with the findings.

AI generates code that satisfies the prompt — not the business rules it was never given. Static analysis can't catch what only your requirements document knows.

A concise brief on what AI coding assistants do to your security surface, what conventional tooling misses, and what one CI step closes the gap.

Asking an AI to review your AI's code is not a quality control. It's a conversation. Here's why the distinction matters for anyone shipping AI-assisted software.

Generic static analysis tools have a coverage gap specific to AI-generated code. These questions separate AI-aware tools from legacy scanners in a vendor evaluation.