Skip to content

● Conductor cloud closes Nov 20. Switch →

New: CoderBaba Security

Find, verify and fix security holes from your terminal

CoderBaba scans your app for the mistakes that get apps hacked, proves which ones are real on your own machine, and fixes them with checks. Free and open source.

$ npm install -g coderbaba
How it works
~/my-app — zsh

More than a list of warnings: find what matters, prove it, fix it.

Find

A deep scan that reads code like a reviewer

CoderBaba maps your app first: routes, how login works, where data is stored and where untrusted input enters. Then it reviews each app folder against that map, tracing input across files instead of matching patterns one line at a time.

Validate

Findings reproduced on your machine

/security validate starts your app and tries each finding with requests to localhost only, using test data it creates. Each finding comes back confirmed, false positive or needs review, with the command and response as evidence.

Fix

Patches that are checked, not just suggested

/security fix S1 makes the smallest change that closes the hole, runs your typecheck and lint, and re-runs the reproduction to show it no longer works. You approve every edit, and /undo reverts it.

across your workflow

Security at every step, not once a year

  1. 01

    While it writes code

    Secure defaults are part of CoderBaba's instructions: parameterized queries, hashed passwords, auth on routes that change data, validated request bodies and no user input in shell commands.

  2. 02

    Before you commit

    /security diff reviews only your uncommitted changes, or your branch against a base such as main, and gives a verdict: safe to commit, or the findings to fix first.

  3. 03

    When dependencies change

    Whenever CoderBaba edits package.json, a lockfile or requirements.txt, it runs npm, pnpm or yarn audit (and pip-audit when it's installed) and warns you about high-severity advisories.

what it checks

The mistakes that get real apps hacked

Every finding in the report has the file and line, the risk in plain words, the fix, and evidence once it's validated.

  • SQL, NoSQL and command injection
  • Routes with no auth check
  • Records loaded by id without an ownership check
  • Hardcoded secrets and .env files tracked by git
  • CORS, cookie, JWT and Django settings
  • Passwords stored without hashing
  • XSS through innerHTML and friends
  • SSRF and path traversal
  • Vulnerable npm and PyPI packages
SECURITY_REPORT.md
## High

### S1: Notes API has no auth check
confirmed · auth · server/routes/notes.js:12

Risk: Anyone can delete any user's notes with
DELETE /api/notes/:id, no login needed.

Fix: Add the requireAuth middleware and check
note.userId === req.user.id before deleting.

Evidence:
> curl -X DELETE localhost:5000/api/notes/66f1…
> 200 {"deleted":true}

security & privacy

Built to be trusted with your code

Your code stays yours

Chats are saved on your machine. Our server records usage for each request (the model, token counts and cost) and doesn't store your prompts or code.

No providers that keep data

Model requests are routed only to providers that don't store or train on prompts, both in our cloud and when you bring your own OpenRouter key.

Secrets never enter the chat

Passwords and API keys go straight into your .env file through a hidden prompt. Findings and reports name the variable, never the value.

You approve what runs

Edits and commands ask first unless they're on the read-only safe list. Files that control what runs without asking always ask again.

Localhost only

Validation sends requests only to your app running on your machine, never to other hosts, and never deletes existing data.

Open source

Every prompt and rule CoderBaba uses is in the open-source code, so you can read exactly what it does.

CoderBaba Security is an automated review. It doesn't replace a professional security audit or penetration test.

Why apps built with AI agents need a security pass

Coding agents are very good at making things work. They're less reliable at making things safe, because a working app and a safe app look the same in a demo. A notes API that deletes any note by id works perfectly until someone changes the id in the URL. A login form that compares plain-text passwords works until the database leaks. Most real breaches in small apps come from a short list of mistakes like these, not from exotic attacks.

CoderBaba Security is built around that short list. It looks for the issues that are both common and serious, proves which ones are real, and fixes them in the same session.

The five commands

  • /security runs the deep scan and writes SECURITY_REPORT.md. It reads code and runs a dependency audit, and it never edits files.
  • /security validate reproduces the most urgent high and medium findings against your app on localhost. Pass an id, such as /security validate S2, to check one finding.
  • /security fix S1 fixes one finding, runs your project's checks, and re-runs the reproduction to confirm the fix.
  • /security diff reviews uncommitted changes. /security diff main reviews everything on your branch since main.
  • /security status lists every finding with its severity and status, without calling a model.

How to read the report

Findings are grouped by severity:

  • High: an outsider can read or change other people's data, run code on your server, or take over accounts.
  • Medium: it needs special conditions or a logged-in user.
  • Low: hardening that makes other attacks harder.

Each finding also has a status. Open means the code shows the problem. Confirmed means it was reproduced on your machine. False positive means a reproduction showed it isn't reachable. Needs review means a person should look. Fixed means the change was made and checked.

When several small findings combine into one bigger attack, for example an id taken from the URL plus a missing ownership check, the report links them under Attack chains. Fix the chain's first link and the whole attack usually stops working.

A good routine

  1. Run /security once you have a working first version of your app.
  2. Run /security validate, then fix confirmed high findings first with /security fix.
  3. Before each commit that touches routes, auth or database code, run /security diff.
  4. Let CoderBaba's automatic audits warn you when dependencies change, and update packages that have high-severity advisories.
  5. Re-run /security before you share the app with real users.

What it doesn't do

CoderBaba Security doesn't scan servers you don't run, doesn't attack hosts other than localhost, and can't see hosting settings, cloud permissions or third-party dashboards. The report lists these under Not checked. It's a fast, free first line of defense, not a certificate that your app is secure.

CoderBaba Security FAQ

What happens when I run /security?

CoderBaba builds a threat model of your project, reviews each app folder (such as client/ and server/) with that model in mind, runs a dependency audit, and then merges duplicates, links findings that combine into a bigger attack and ranks them. The results go into SECURITY_REPORT.md. It doesn't change any files during a scan.

How is this different from a linter or npm audit?

Linters match patterns line by line. CoderBaba follows where input comes from and where it ends up across files, so it can tell whether a query really uses user input or whether a route really has no auth check. Dependency audits are one part of the scan, not the whole thing.

Does it replace a penetration test or a security audit?

No. It catches common, serious mistakes early and cheaply, especially in apps you're building with an AI agent. For apps that handle payments, health data or other sensitive information, still get a professional review.

Where does validation run?

On your machine. CoderBaba starts your app the way it normally runs and sends requests to localhost only, using test data it creates. It never sends requests to other hosts.

What data leaves my machine?

The code CoderBaba reads during a scan is sent to the model, as in any chat. Requests are routed only to providers that don't store or train on prompts, and our server keeps usage numbers, not content. Secret values are replaced before anything is sent.

What does it cost?

Nothing, and you don't need to sign in. Scans run on the free Fast model. Logging in (also free) unlocks the Smart model for deeper reviews.

Should I commit SECURITY_REPORT.md?

Not to a public repository. It lists weaknesses in your app. Fix the findings first, then delete it or keep it private.

Scan your app in one command

Install with npm install -g coderbaba, open your project, and type /security. Free, no sign-in needed.

$ npm install -g coderbaba
How CoderBaba works