CodeWatch 🔒

Security pattern detector for AI-generated code. Catches the dangerous patterns that AI coding agents (Cursor, Copilot, Claude Code, etc.) commonly introduce — directly in your git workflow.

The Problem

AI coding agents are fast, but they make predictable security mistakes:

• Hardcode API keys and database credentials
• Use eval() and string concatenation in SQL/commands
• Disable TLS verification to "make it work"
• Leave console.log() and debugger statements everywhere
• Write path traversal vulnerabilities from unsanitized user input
• Use weak hashing algorithms and hardcoded JWT secrets

CodeWatch scans your git diff and catches these patterns before they reach production.

Install

npm install -g codewatch

Usage

Scan unstaged changes

codewatch scan

Scan staged changes (for pre-commit hooks)

codewatch scan --staged

Compare against a branch

codewatch scan --target main

Pipe a diff directly

git diff main | codewatch scan --diff "$(cat)"

Output formats

codewatch scan --output json    # JSON
codewatch scan --output sarif   # SARIF (for GitHub Advanced Security)
codewatch scan --output text    # Pretty terminal output (default)

Pre-commit hook

Add to .git/hooks/pre-commit:

#!/bin/sh
codewatch scan --staged --fail-only

CI/CD integration

# GitHub Actions
- name: CodeWatch Security Scan
  run: |
    npm install -g codewatch
    codewatch scan --target origin/main --output sarif > codewatch.sarif
    codewatch scan --target origin/main --fail-only

Rules

| Rule | Severity | What It Catches | |------|----------|-----------------| | Hardcoded Secrets | Critical | API keys, tokens, passwords, private keys, DB credentials | | Injection Vulnerabilities | Critical | Command injection, SQL injection, eval() usage | | Path Traversal | Critical | User-controlled file paths in filesystem operations | | Weak Auth Patterns | Critical | MD5/SHA1 hashing, weak JWT secrets, hardcoded passwords | | Insecure Patterns | High/Medium | Disabled TLS, wildcard CORS, Math.random(), chmod 777 | | Debug Artifacts | Low | console.log, print(), debugger, TODO/FIXME comments |

List all rules

codewatch rules

Configuration

Create .codewatch.json in your project root:

{
  "rules": {
    "enabled": [],
    "disabled": ["ai-debug-artifacts"]
  },
  "severity": {
    "failOn": ["critical", "high"]
  },
  "output": "text"
}

Programmatic API

import { runScan, parseGitDiff } from 'codewatch';

const files = parseGitDiff(diffString);
const result = runScan(files);

console.log(`Found ${result.findings.length} issues in ${result.filesScanned} files`);

Languages Supported

TypeScript, JavaScript, Python, Go, Rust, Ruby, Java, PHP

License

MIT