#code review tools Startups & Tools

Security gaps in AI-generated code follow predictable patterns. Disabled row-level security in Supabase, hardcoded API keys, unauthenticated API routes, and missing CORS boundaries show up repeatedly in code scaffolded by Cursor, Lovable, Bolt, v0, Replit, or Windsurf. Generic vulnerability scanners miss these mistakes because they're not looking for the specific architectural oversights that AI generators tend to produce. Vibecheck fills that gap by bundling gitleaks, semgrep, and njsscan into a single workflow, then using Claude to analyze results and explain what actually matters. Rather than presenting raw scan output, it prioritizes findings by severity and business impact. For developers shipping fast, this triage layer saves hours sorting through false positives. Getting started requires no account. Paste a live URL to check headers, TLS, CORS, and cookie flags immediately. Developers who want to scan source code can connect GitHub and run the full suite of 65 checks across 11 categories: secrets and exposure, access control, injection vulnerabilities, and server-side issues. The VS Code extension allows scanning before deployment without leaving the editor. The feature set targets real vulnerabilities in rapidly developed applications. Beyond obvious issues like hardcoded JWT tokens or SQL injection, it catches subtle misconfigurations: NEXT_PUBLIC_ secret exposure, Supabase service role keys in client code, GraphQL introspection left enabled in production, and IDOR flaws from missing ownership checks. The 50 custom checks handle patterns that open-source scanners don't catch. User testimonials reveal substantial value. One developer discovered a completely unsecured Supabase table during a pre-deployment scan. Another runs the scanner against five live products before every deploy, calling it the check they wished existed earlier in their career. The feedback emphasizes that Claude's triage actually reads like human review, not a generic wrapper around existing tools. The freemium approach—allowing live URL scanning without registration and GitHub integration with no cost—targets independent developers and small teams. The Product Hunt and VS Code Marketplace presence indicate a distribution strategy built for developers who already use AI-assisted code generation. For teams shipping applications with AI coding assistants, vibecheck addresses a real blindspot in existing security practices.

Architectural decay in AI-assisted coding happens fast. As code agents like Claude Code and Cursor generate multiple edits across dozens of tool-calls in a single session, violations of project structure can slip through undetected until they accumulate into technical debt. Archlint addresses this by moving architectural validation from the CI pipeline into the agent's editing loop, catching violations the moment they occur so corrections happen immediately rather than weeks later during code review. The tool works by declaring a project's layer structure and dependency rules upfront—defining which components can import from which others—then validating every edit the agent makes against those rules in real time. It supports six languages: Python, TypeScript and JavaScript, Go, Rust, Java, and C#, with import resolution sophisticated enough to handle real-world complications like tsconfig path aliases, Python src/ layouts, and Go module paths. The system doesn't require an architectural blueprint; teams new to Archlint can run its initialization tool to generate rules from their existing directory structure and import patterns, then refine them in minutes. What distinguishes Archlint is its positioning as a guardrail for AI agents rather than a general architecture linter. The product's own telemetry shows an 86 percent self-correction rate—meaning the agent detects violations and fixes them within the same session 14 times out of roughly 16 when drift is introduced. This metric captures something important: the tool's value isn't primarily about stopping bad code but about catching it early enough that remediation is trivial. The implementation is spare. Archlint is pure Python with no external dependencies, keeping deployment friction low and the attack surface minimal. It integrates with both Claude Code and Cursor, delivering per-edit feedback in Claude Code and end-of-turn summaries in Cursor. For teams adopting it into existing codebases with established architectural violations, the baseline mode allows rules to be adopted gradually—flagging only new drift rather than demanding immediate compliance with historical violations. The product is sold at a flat $20 price, making it accessible to individual developers and teams. For organizations where architectural integrity matters—teams managing microservices, plugin architectures, or domain-driven designs where layer violations compound into significant problems—the cost justifies itself through prevented rework.