//Blog
Notes from building a scanner for AI-written code.
What AI-generated apps actually get wrong, why conventional scanners don’t see it, and the bugs we shipped ourselves along the way.
Accuracy2 min read
A leaked key isn’t a finding until you know it still works
Pattern-matching can’t tell a live credential from one you rotated last year. Calling both “critical” is how a scanner gets ignored.
ReadEngineering2 min read
Your Anthropic key was being verified against OpenAI
A four-character oversight in a regex meant every Anthropic key was reported twice and checked against the wrong company’s API. Here’s how it surfaced.
ReadAI blind spots2 min read
The secret that isn’t in your JavaScript
A Server Component passes an API key to a Client Component as a prop. The code is correct React, the key is in no .js file, and View Source is enough to read it.
ReadAccuracy2 min read
Your .env.local is not a vulnerability
We shipped a check that reported a correctly-gitignored .env.local as a critical committed secret. It fired on almost every healthy repo. Here’s what went wrong.
Read