A security scanner that phones home has a trust problem. How BrassCoders 2.1.0 made telemetry off by default, readable before it sends, and easy to refuse.

Sourced: Veracode found 45% of AI code carries an OWASP Top 10 flaw, CodeRabbit measured 1.7x more issues per PR, and ~20% of AI-suggested packages don't exist.

Vibe coding ships fast. The O(N²) loop, the hardcoded secret, the hallucinated import — they ship too. BrassCoders catches all four bug classes in 30 seconds.

All 12 scanners are free in the OSS core; Paid adds ranking, not detection. The honest line on when free is enough and when $12/dev/month pays off.

The OSS core finds everything; the Paid plan ranks it. In one published case study, BrassCoders Paid took a scan from 2,470 raw findings to 217 after heuristic reduction to 22 after enrichment, for $12 per developer per month.

BrassCoders runs a Babel-based JavaScript and TypeScript scanner on .js and .ts files automatically, catching secrets and security patterns alongside Python.

AI assistants drop real-looking names, emails, and SSNs into fixtures and stubs. BrassCoders flags PII-shaped strings in source before they reach a shared repo.

Veracode found 1 in 5 AI-generated SQL snippets still vulnerable, and a 2022 study put Copilot's SQL injection rate at 37%. The numbers, and how to catch it.

AI test generators hit 80% coverage on toy benchmarks and under 2% on real code. Coverage counts execution, not verification. The numbers, and the real check.

BrassCoders bundles Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, and detect-secrets into one scan: one install, one ranked YAML, no six-tool config.