If you use AI coding assistants (Cursor, Copilot, Windsurf), you already know the pattern: the code looks right, the tests pass, and then production breaks with a bug that was sitting in plain sight.

I built AINAScan to catch exactly those bugs — and today it scans entire projects via ZIP upload, not just single files.

🔗 ainascan.dev — try it free →

What it scans

48 patterns across 3 categories — pure AST analysis, no LLM guessing:

🛡 Security (24 patterns — BLOCK)

The ones that will get you in the news:

🤖 Vibe-Coding Structural Bugs (13 patterns — BLOCK)

These are the AI-specific ones. Semgrep doesn't catch them. Bandit doesn't either.

# DEAD_DB_RESULT — AI fetched data and forgot to use it
def get_user_stats(user_id):
    rows = db.execute("SELECT * FROM events WHERE user_id=?", (user_id,)).fetchall()
    return {"status": "ok"}  # ← rows is never used

# STUB_SKELETON — AI wrote the function signature and stopped
def process_payment(amount, card_token):
    pass  # ← production code

# INPUT_OUTPUT_DISCONNECTED — parameters have no effect on return
def validate_email(email):
    return {"valid": True}  # ← ignores the email entirely

# MISSING_WRITE — save() with no actual INSERT/UPDATE
def save_user(data):
    return {"status": "saved"}  # ← no DB write happened

These patterns show up in AI-generated code constantly. The model writes a plausible function signature and return value, but the logic in between is missing.

🏗 Design Smells (11 patterns — WARN)

God objects, circular imports, refused bequests, duplicate code blocks — the Martin Fowler classics, caught automatically.

ZIP / Folder Scan — scan your whole project at once

This is the big one. Instead of uploading files one by one:

1. Zip your project folder
2. Drop it on AINAScan
3. Get results for up to 200 files in parallel

Every file gets the full 48-pattern check. The results show:

• Total BLOCK / WARN counts across the project
• Per-file breakdown
• Which files are clean vs. which need attention

Max ZIP size: 50 MB. Free for members (star the GitHub repo to unlock).

What the scan results look like

For each file you get:

1. Pattern checklist — all 48 checks, ✅ PASS / 🔴 BLOCK / ⚠️ WARN per pattern

2. Senior Code Analysis — 7 additional patterns:

• SILENT_FAILURE — broad except that always returns success
• EMPTY_EXCEPT — except: pass (error swallowed silently)
• DEEP_NESTING — 5+ levels of nested if/for
• PARAM_SHADOW — parameter reassigned inside function
• INCONSISTENT_RETURN — mixed None and typed returns

3. Code Structure

• Function count, class count, danger sinks, validators
• Detected libraries (subprocess, sqlite3, requests...)
• Full function list with SINK / VALIDATOR badges
• Mermaid call graph source

4. 🧠 AI Confidence badges on each BLOCK issue

BLOCK  SQL_INJECTION_RISK  line 47  🧠 98% · L3×6

The 🧠 98% · L3×6 means AINA's Phase 3 causal reasoning engine is 98% confident this is a real vulnerability, backed by 6 L3 causal chain matches from its knowledge base (1.9M+ edges, 133K+ causal relations).

High confidence (≥90%) = red badge. Medium (≥70%) = orange. Below = grey.

What it catches that others miss

Synthetic test cases based on real AI-generated bug patterns:

The interprocedural taint tracking is worth calling out — it catches cases where tainted user input passes through a function boundary before hitting a dangerous sink. Most free tools don't do this.

9 languages supported

Python · JavaScript · TypeScript · Go · Ruby · Java · PHP · Kotlin · C/C++

Python gets the deepest analysis (all 48 patterns + senior analysis + structure + AI advisor). Other languages get the core security patterns via tree-sitter AST.

How to use it

Single file:

1. Go to AINAScan
2. Paste your code or upload a file
3. Click Scan

Whole project (ZIP):

1. ⭐ Star github.com/Moonsehwan/aina-scan
2. Sign in with GitHub (unlocks ZIP scan + scan history + 7-section docs)
3. Zip your project, drop it on the ZIP scanner
4. Get results for all files in ~10 seconds

Free for members. No code is stored on the server — everything is analyzed in memory and discarded after the response.

7-Section Auto Documentation

Member feature: upload a ZIP and get a Markdown document with:

1. Project Structure — file tree + function/class/API counts
2. Function Reference — name · line · params · return type
3. Dependencies — requirements.txt parsed
4. Mermaid Diagram — module dependency graph
5. API Endpoints — FastAPI/Flask auto-detected
6. DB Schema — SQLAlchemy Column extraction
7. Validation Status — BLOCK/WARN summary per file

Pure AST — no LLM, no API calls, instant.

The benchmark numbers

• P=R=F1=100% on 90-case benchmark (30 TP + 30 TN Python, 30 multilang)
• Zero false positives on top-10 open source repos (10/10 clean)
• 9 languages · tree-sitter AST · deterministic

If you're shipping AI-generated code and want a second opinion before it hits production — give it a try. Takes 5 seconds per file.

Feedback welcome in the comments — especially if you find a false positive or a pattern we're missing.