XploitScan

Security scanner for AI-generated code. Find vulnerabilities before attackers do.

Built for developers shipping code via Cursor, Lovable, Bolt, Replit, and Claude Code. 210+ security rules. Plain-English results. Copy-paste fixes.

Quick Start

npx xploitscan scan .

No install, no config, no account required. Your code stays 100% local.

What It Catches

210+ rules across 15+ categories:

| Category | Examples | Rules | |----------|---------|-------| | Secrets | Hardcoded API keys, .env files, OAuth secrets, Terraform state | 15+ | | Injection | SQL, XSS, SSRF, command injection, path traversal, XXE, SSTI | 20+ | | Authentication | Missing auth, weak JWT, insecure password reset, OAuth flaws | 15+ | | Cryptography | Weak RSA, deprecated TLS, ECB mode, hardcoded IVs | 10+ | | Infrastructure | Dockerfile, Kubernetes, Terraform, AWS IAM misconfigs | 10+ | | Supply Chain | Unpinned GitHub Actions, vulnerable dependencies | 5+ | | Information Leakage | PII in logs, unencrypted DB fields, exposed admin routes | 10+ | | Code Quality | Console.log in production, empty catch blocks, TODO/FIXME | 10+ |

Every finding includes OWASP Top 10 and CWE compliance mappings.

Detection Quality

Detection is scored publicly on a labeled fixture corpus that's refreshed on every commit. Current numbers live at xploitscan.com/benchmark:

• 100% precision (zero false positives) across a 200+ fixture labeled corpus covering 25+ vulnerability classes
• 98%+ recall — live numbers at xploitscan.com/benchmark
• Side-by-side comparison with Semgrep (community rulesets) and Bearer on the same corpus

The scanner uses a two-layer architecture: a fast regex pre-filter for pattern-based rules (secrets, missing headers, container misconfigs), and a Babel-parsed AST layer with local taint tracking for data-flow rules (SSRF, prototype pollution, mass assignment, SSTI, command injection from user input). Recognized taint sources: Express / Fastify / Koa / Next.js App Router / Web Fetch API / AWS Lambda.

Methodology, fixture format, and reproducibility instructions: xploitscan.com/docs/detection-methodology.

Installation

# Run directly (recommended — always latest version)
npx xploitscan scan .

# Or install globally
npm install -g xploitscan
xploitscan scan .

Usage

# Scan current directory
npx xploitscan scan .

# Scan a specific folder
npx xploitscan scan ./src

# JSON output (for scripting/CI)
npx xploitscan scan . --format json

# SARIF output (for GitHub Security tab)
npx xploitscan scan . --format sarif

# Scan only changed files vs main branch
npx xploitscan scan . --diff

# Watch mode — re-scan on file changes
npx xploitscan scan . --watch

Output Formats

| Format | Use Case | |--------|----------| | text | Human-readable terminal output (default) | | json | Machine-readable JSON with all findings | | sarif | GitHub Security tab integration |

GitHub Action

Add automated scanning to every PR:

name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run XploitScan
        uses: bgage72590/xploitscan@main
        with:
          path: '.'
          format: 'sarif'
          fail-on: 'critical'

      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: xploitscan-results.sarif

Findings appear in the GitHub Security tab as code scanning alerts.

Configuration

Create a .xploitscanrc file in your project root:

{
  "rules": {
    "include": ["VC001-VC131"],
    "exclude": ["VC042"]
  },
  "format": "json",
  "fail-on": "high",
  "ignore": ["node_modules", "dist", ".git"]
}

.xploitscanignore

A .gitignore-style file in your project root. Plain lines exclude whole files from scanning (negate with !). A line may also carry a trailing rule-ID list to suppress only those rules on matching paths while still scanning the files for everything else:

# Don't scan generated code at all
generated/**

# Allow log-injection (VC044) in internal cron scripts only
scripts/cron/**        VC044

# Silence two rules across all test files
**/*.test.ts           VC031, VC043

# Suppress every rule on a legacy tree (the `scanner` wildcard)
legacy/**              scanner

For a single reviewed-and-accepted finding, prefer an inline // VC<id>-OK: <reason> comment instead of a file- or path-wide rule.

Where it is looked up. Every .xploitscanignore between your project root and the directory being scanned applies, so xploitscan scan packages/web/src still honours the file at the top of the repo. Patterns are interpreted relative to the file that declares them — a root file naming packages/web/src/lib/demo.ts matches that file whether you scan the repo root or packages/web/src — and a nested file takes precedence over a broader rule above it, the same way .gitignore does.

Vendored and generated code

Some of what a scanner finds isn't code you wrote. AI app builders copy shadcn/ui into your project verbatim; codegen writes into __generated__/; your README contains example code that exists to show what not to do.

XploitScan scans all of it and reports everything it finds — but findings in these paths don't count toward your grade or the CI exit code:

**/components/ui/**      **/shadcn/**        **/ui/shadcn/**
**/vendor/**             **/vendored/**      **/third_party/**
**/generated/**          **/__generated__/**
**/*.md                  **/*.mdx
.claude/**  .agent/**  .cursor/**  .superpowers/**  .windsurf/**

They still appear in every report, tagged [not graded], with the count shown next to the grade. Nothing is hidden — a grade that held findings out always says so.

Hardcoded credentials are the exception and are always graded, in every path above. A key committed to your repository is live no matter which directory holds it, so "the generator wrote that file" doesn't apply. A service-role key in __generated__/client.ts or a plaintext Kubernetes Secret under generated/ still counts against your grade.

Why: shadcn's chart.tsx writes CSS custom properties through dangerouslySetInnerHTML, which trips a critical XSS rule. It ships byte-identically in a large share of AI-scaffolded projects, and one critical caps a project at grade D. Grading it means grading shadcn's code as yours.

To opt out and grade everything:

xploitscan scan . --grade-vendored

Or persistently, in .xploitscanrc:

{ "scan": { "gradeVendored": true } }

Web Dashboard

Scan via the web at xploitscan.com:

• Drag-and-drop file/ZIP upload
• GitHub URL scanning
• Scan history and score trends
• PDF security reports
• SOC2/ISO27001 compliance mapping
• Slack and Discord webhook notifications

Free: 5 scans/day, 30 core rules. Indie ($9/mo): 500 scans/month, all 210+ rules, scan history. Pro ($19/mo): unlimited scans, all 210+ rules, PDF reports, compliance mapping, webhooks, AI false-positive filter. Team ($99/mo): everything in Pro plus 5 seats, shared scan history, RBAC, and portfolio reports. Annual plans save 40%.

Supported Languages

JavaScript, TypeScript, Python, Ruby, Go, Rust, Java, PHP, Swift, Kotlin, C#, Dart, C/C++, and configuration files (Dockerfile, Terraform, Kubernetes, GitHub Actions, .env).

Links

• Website: xploitscan.com
• Documentation: xploitscan.com/docs
• Changelog: xploitscan.com/changelog
• Email: [email protected]

License

MIT -- Cipherline LLC