I'm Diego, and I built vigil because every security scanner I know was designed for code written by humans, and the code we're shipping in 2026 isn't written by humans anymore. Here's the problem. AI coding agents (Claude Code, Cursor, Copilot, Kiro) are incredibly productive, but they introduce a new class of security issues that traditional tools like Semgrep, Snyk, or CodeQL simply don't detect: 20% of packages recommended by LLMs don't exist in any registry. Attackers register those names to inject malware. It's called slopsquatting, and it's happening right now. 58% of hallucinated dependencies are repeatable, they're not random noise, they're predictable attack vectors. LLMs generate "test theater", tests that boost coverage numbers but assert nothing. Your CI passes green while your code is broken. Agents copy placeholder secrets from .env.example straight into source code. They hardcode JWT secrets as "supersecret123" and set CORS to * because they optimize for "it works", not "it's secure." Existing tools can't catch this. Snyk checks CVEs, but hallucinated packages don't have CVEs because they're not real packages. Semgrep analyzes patterns, but it can't verify that a dependency exists in PyPI. Coverage tools count lines, but they can't tell you that assert True isn't testing anything. Vigil catches exactly these problems. Here's what it does: 🔍 Dependency hallucination detection --> Verifies every dependency actually exists in PyPI and npm. Flags packages younger than 30 days. Detects typosquatting using Levenshtein distance against popular packages. Checks download counts and source repo existence. 🔐 Auth & permission pattern analysis --> Finds DELETE/PUT endpoints without auth middleware, JWTs with 72-hour lifetimes, wildcard CORS, hardcoded secrets, and insecure cookie configs. Supports FastAPI, Flask, and Express patterns. 🔑 AI-specific secrets detection --> Traces values from .env.example into source code. Catches placeholder secrets using Shannon entropy analysis. Detects embedded connection strings with credentials. 🎭 Test quality analysis (anti-"test theater") --> Identifies tests with zero assertions, trivial checks like assert x is not None, exception swallowing, and mock mirrors that test nothing real. 📊 4 output formats --> Human-readable terminal, JSON, JUnit XML, and SARIF 2.1.0. SARIF means native integration with GitHub Code Scanning and GitLab SAST out of the box. What makes vigil fundamentally different: - Deterministic. No LLM, no AI, no API calls to function. Static rules + registry verification + heuristics. Fast, predictable, zero cost per scan. - Agent-agnostic. Works on code from Claude Code, Cursor, Copilot, Kiro, or raw LLM output. It analyzes code, not agent metadata. - Complementary, not competitive. vigil doesn't replace your existing security stack. It covers the gap that Semgrep, Snyk, and CodeQL weren't designed for. Run them all. ~25 detection rules across 4 categories, all mapped to OWASP Top 10 for LLM Applications and CWE references. Think of it this way: if your CI/CD pipeline were an airport security checkpoint, Semgrep is the metal detector, Snyk is the baggage scanner, and vigil is the customs agent asking "where did this come from, and does it actually exist?" Install with pip install vigil-ai-cli. Python 3.12+. Works on Linux, macOS, and Windows. Configurable via .vigil.yaml. Supports Python and JavaScript/TypeScript projects. I'd love your feedback, especially on which languages and frameworks to prioritize next (Go, Rust, Java are on the roadmap), and which detection categories matter most to your team. Star the repo if this is useful!

Vigil

Security scanner built for AI-generated code.

Security scanner built for AI-generated code.