Free security scanner for AI/LLM apps

Scan your AI-agent code for the holes attackers hit first.

Paste your Python — FastAPI / Flask / LangChain / LlamaIndex / model-server code — and get an instant static scan for the vulnerability classes I actually reproduce in production AI open source: SSRF, unsafe model loading, eval/exec RCE, prompt-injection tool abuse, hardcoded secrets, path traversal and missing auth.

Nothing leaves your browser. The scan runs entirely in client-side JavaScript — no upload, no server, no logging. View source and confirm.

Paste Python code (a route, a tool, a loader — or a whole file)

—

$19 This scanner flags the patterns. The Ship-Secure LLM Apps Pack gives you the full 24-point review checklist, copy-paste hardening code (drop-in SSRF guard, safe path/loader, secret bootstrap) and 3 real reproduced exploit walkthroughs — everything to actually close the holes. Get the hardening pack — $19

Or read the free 12-point checklist first.

What it checks

Heuristic static patterns — a flag means "look here", not a proven exploit. Confirm the sink is reachable from untrusted input before you act. It won't catch everything and it has false positives; it's a fast first pass, not a substitute for review.

SSRF — outbound fetch (requests/httpx/aiohttp/urllib) reachable from user-supplied URLs.
Unsafe deserialization / model loading — pickle, torch.load without weights_only, yaml.load, joblib, dill.
RCE — eval/exec/__import__, os.system, subprocess(..., shell=True).
Prompt-injection tool abuse — side-effecting agent tools with no allowlist/confirmation.
Secrets — hardcoded API keys, tokens, SECRET_KEY, passwords.
Path traversal — file reads built from request data.
Missing auth — unauthenticated WebSocket / route handlers.
SQL injection, CORS *, debug=True, missing request timeouts.