This isn't a hypothetical problem
of tests across 100+ LLMs produced AI-generated code with an OWASP Top 10 flaw.
Veracode, 2025 GenAI Code Security Report→of 1,692 Copilot-generated programs across 89 scenarios contained an exploitable bug or design flaw.
NYU Tandon, “Asleep at the Keyboard?”→of real-world Copilot-generated Python snippets in GitHub projects had a security weakness.
“Security Weaknesses of Copilot-Generated Code,” 2025→How it works
Open a PR
CodeMoat runs automatically on pull_request and scopes every scan to just the changed lines — not the whole repo.
Three engines, one pass
Semgrep for pattern-based SAST, Gitleaks for secrets, and CodeMoat's own 12-rule pack for AI-agent-specific footguns.
One clean PR comment
Severity, file, line, CWE reference, and a suggested fix — in a single comment that updates in place. No spam.
What generic scanners miss
CodeMoat's AI ruleset targets the specific ways coding agents fail — not textbook injection flaws, but the shortcuts an agent takes to get a feature working.
Install
Add a workflow file to your repo:
# .github/workflows/codemoat.yml
name: CodeMoat
on:
pull_request:
permissions:
contents: read
pull-requests: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: SYCO7/codemoat@v1Or run it locally before you push, no CI required:
npx codemoat scan
Free & open source
Unlimited scans on public and private repos. No plans, no payment, no limits — the whole thing is MIT-licensed on GitHub.