AI Security Engineer

TheAI Security EngineerThat Lives Inside EveryPull Request

Zero-config GitHub App. Millisecond AST scans. Contextual AI fixes as review comments. Dismiss false positives so your team focuses on real issues.

Install GitHub App Free Live Demo

Free, instant, no account needed — we analyze public code and show you real findings.

pinelightlabs/example-repo

mainfeat/security-fix

1 check pending#42

Security Audit Results: SQL Injection Detected

pinelight[bot]illustrative example1 file

Product demo

src/api/users.ts

@@ -1,13 +1,14 @@

1app.get('/api/users/:id', async (req, res) => {

2 const { id } = req.params;

4 const query = `SELECT * FROM users WHERE id = '${id}'`;

6 const user = await db.execute(query);

8 if (!user) {

9 return res.status(404).json({ error: 'User not found' });

10 }

12 res.json(user);

13});

AI-generated fix applied

1app.get('/api/users/:id', async (req, res) => {

2 const { id } = req.params;

4 const query = 'SELECT * FROM users WHERE id = $1';

5 const values = [id];

7 const user = await db.execute(query, values);

9 if (!user) {

10 return res.status(404).json({ error: 'User not found' });

11 }

13 res.json(user);

14});

CRITICAL

SQL Injection

CWE-89 · OWASP Top 10 A03:2021

AI Engine Analysis

Scanning repository — parsing AST and running detectors...

Suggested Fix

const query = 'SELECT *
FROM users WHERE id = $1';
const values = [id];
await db.execute(query, values);

Merge Approved

All security checks passed

1 review1 check pending

Detectors

Everything you need to ship secure code

AST-powered detection engine with context-aware AI. Scans every PR in milliseconds.

AST Analysis

Full Abstract Syntax Tree parsing for deep code understanding

ExpressionStatement

CallExpression

Identifier (db.execute)

Secrets Detection

Find hardcoded API keys, tokens, and credentials instantly

⚠️ API_KEY = "sk-..."

⚠️ password = "admin123"

✓ process.env.API_KEY

SQL Injection

Detect query concatenation and parameter injection vectors

✗ `SELECT * FROM users

WHERE id = ${id}`

✓ SELECT * FROM users

WHERE id = $1

XSS Detection

Catch cross-site scripting via innerHTML and dangerouslySetInnerHTML

✗ el.innerHTML = input

✗ dangerouslySetInnerHTML

✓ el.textContent = input

Path Traversal

Prevent unauthorized file system access via malicious paths

✗ fs.readFile("../etc/")

✗ path.join(userInput)

✓ path.resolve(SAFE_DIR, input)

AI Code Fixes

Contextual fixes generated as GitHub review comments

🤖 Suggested fix:

Use parameterized query

Confidence: 90%

Low False Positives

Severity-ranked findings with confidence scores and CWE references

✓ Confidence-scored findings

✓ CWE + OWASP references

✓ Honest empty states

Team Management

Invite teammates and manage roles per organization

📧 Invite teammates

Roles: Owner / Admin / Member

Shared org dashboard

100ms Scan

Ultra-fast AST parsing completes before you switch tabs

⏱️ Scan completed

Duration: 47ms

Files: src/**/*.ts

GitHub Native

Works inside every Pull Request with zero configuration

🔗 Connected to GitHub

Watching 3 repositories

Active on feature/* branches

CI/CD Ready

Blocks vulnerable code before it reaches production

⚡ CI Pipeline

Scan: 3 vulnerabilities

Blocking merge until resolved

Live Examples

See how AI fixes real vulnerabilities

Every fix is generated in context and posted as a GitHub review comment with confidence scoring.

SQL Injection

CRITICAL

Injection

Auto-rotating

1// ❌ Vulnerable: string interpolation in query

2const getUser = async (id: string) => {

3 const query = `SELECT * FROM users WHERE id = '${id}'`;

4 return db.execute(query);

5};

SQL injection detected — click "Fixed" to see the AI-generated fix

Secret Leak

CRITICAL

Information Disclosure

Auto-rotating

1// ❌ Vulnerable: hardcoded secret

2const API_KEY = 'sk-1234567890abcdef';

3const config = {

4 apiKey: API_KEY,

5 database: {

6 password: 'admin123!'

7 }

8};

Hardcoded secret detected — click "Fixed" to see the AI-generated fix

Cross-Site Scripting

HIGH

Injection

Auto-rotating

1// ❌ Vulnerable: unsanitized HTML injection

2const renderComment = (comment: string) => {

3 const el = document.getElementById('comments');

4 el.innerHTML = comment;

5 el.innerHTML += '<div>' + userInput + '</div>';

6};

Cross-site scripting detected — click "Fixed" to see the AI-generated fix

Path Traversal

HIGH

File System

Auto-rotating

1// ❌ Vulnerable: unsanitized file path

2const readFile = async (path: string) => {

3 const content = await fs.readFile(

4 path.join(__dirname, path)

5 );

6 return content;

7};

Path traversal detected — click "Fixed" to see the AI-generated fix

Command Injection

CRITICAL

Execution

Auto-rotating

1// ❌ Vulnerable: shell command injection

2const runBuild = (branch: string) => {

3 exec('git checkout ' + branch, (err, out) => {

4 console.log(out);

5 });

6};

Command injection detected — click "Fixed" to see the AI-generated fix

Integrations

Fits into your existing stack

Works wherever your code lives. No setup required beyond installing the GitHub App.

GitHub

Native PR integration

platform

TypeScript

Full AST support

runtime

JavaScript

ES2024+ support

runtime

Node.js

Built for the Node ecosystem

runtime

CI/CD

Blocks vulnerable code in PRs

platform

Pricing

Flexible Plans for Every Team

Choose the plan that fits your team's security needs. All plans include our AST-based security scanning engine.

Free

$0/forever

Perfect for individual developers and open-source projects.

100 scans per month
10 security detectors
Public repositories only
7-day scan history
Community support
No credit card required

Start Free

Pro

$99/month

For small teams shipping to production. Early adopter pricing at $49/mo — locked in forever (first 50 customers).

1,000 scans per month
All detectors + AI-generated fixes
Private repositories
CI/CD integration
API access
1-year scan history
Email support

Get Pro

Team

$399/month

For scaling engineering teams and growing companies.

5,000 scans per month
Everything in Pro
Team dashboard & management
Custom security rules
False positive management
SAML/SSO
Slack support

Get Team

Enterprise

Custom

For large organizations with advanced compliance and deployment needs.

Unlimited scans
Everything in Team
On-premise deployment option
Audit logs & compliance reports
Dedicated support & SLA
Custom detectors & integrations
Dedicated Technical Account Manager

Contact Sales

FAQ

Frequently Asked Questions

Our detectors are AST-based rules that target specific, well-known vulnerability patterns. Every finding includes the exact code location, a confidence score, and a CWE reference so you can judge it quickly. No scanner is perfect — we recommend treating findings as review aids, not proof.

Yes, we support both JavaScript and TypeScript. Our parser handles modern ECMAScript features and JSX out of the box.

The GitHub App scans every pull request automatically and posts check runs plus inline comments. That covers most workflows — no pipeline changes needed.

Scans are AST-based and typically complete in milliseconds for a pull request. Large repositories take longer, and scans run asynchronously so your PR flow is never blocked.

The playground processes code in memory and does not persist it. For GitHub scans, only findings metadata (file, line, severity, message) is stored — never your full source code.

Ready to Secure Your Code?

Join thousands of developers who trust Pinelight Labs to find vulnerabilities before they become problems.

Get Started Free→