I Built a Linter That Catches the Security Bugs AI Assistants Keep Writing

Short summary

A developer built hallint, an open-source static analysis tool that targets security vulnerabilities AI assistants commonly introduce — hardcoded secrets, SQL injection, missing auth, permissive CORS, and XSS via innerHTML. The tool combines regex matching, AST analysis, and optional LLM-based semantic review, shipping eight rules with CI-friendly exit codes and npx-based zero-install usage. It fills a gap left by traditional linters like ESLint, which were designed for human failure modes rather than the confident-but-wrong patterns characteristic of AI-generated code.

• •hallint is a free open-source linter targeting AI-specific security bugs like hardcoded secrets, SQL injection, missing auth, permissive CORS, and XSS
• •Three detection layers: regex pattern matching, AST analysis, and optional LLM review via Ollama for deeper semantic checks
• •Ships as npx CLI and npm library with eight rules, severity filtering, and CI gate support via exit code 1 on critical/high findings

Generated with AI, which can make mistakes.