zenveil

ZenVeil is a security scanning tool designed specifically for codebases generated or modified with the help of AI coding assistants. It addresses security risks that commonly arise from AI-generated code, such as hardcoded secrets, missing authorization checks, dependency confusion, and unsafe token storage practices. The tool identifies vulnerabilities that traditional security stacks may overlook because they are tuned for human-written code, not code produced by AI models.

ZenVeil operates by scanning repositories for a range of security issues, including exposed API keys, JWT secrets, AWS credentials, sensitive routes lacking authorization middleware, unpinned dependencies, and tokens written to browser storage like localStorage. It also detects production JavaScript source maps that are publicly accessible and internal-looking scoped packages mixed with unscoped names in package manifests. The scanner references standards such as the OWASP Top 10 and a CVE database, and it employs over 200 secret detection patterns. When a vulnerability is found, ZenVeil can automatically open a GitHub pull request with a proposed fix, streamlining the remediation process.

js, Go, and Ruby. ZenVeil is delivered as a command-line interface, which can be installed with pip, and it integrates with CI/CD pipelines or can be run directly in the browser. Scans are read-only, do not store code, and deliver results in seconds, with internal benchmarks showing full scans of large repositories in under eight minutes.

ZenVeil positions itself as a complement to existing security tools rather than a replacement, focusing on the unique failure modes introduced by AI-generated code. Features like hallucinated package detection, infrastructure-as-code misconfiguration scanning, and prompt-injection surface analysis are indicated as being in development. The tool is available for use without signup for public repositories, and scan results are verified with file-level evidence.