AST scanner for AI-generated code bugs. 48 patterns: MISSING_WRITE, FAKE_ASYNC, SQL_INJECTION_RISK, COMMAND_INJECTION, HARDCODED_SECRET, STUB_SKELETON, BUFFER_OVERFLOW + 41 more. 9 langs: Python, JS, TS, Go, Java, PHP, Ruby, Kotlin, C/C++. Catches what Semgrep/Bandit miss: structurally valid code that doesn't do what the function name says. P=R=F1=100% on 90-case benchmark. Free: key vg_free_test, no signup.