The community's most comprehensive, continuously-updated index of research on Large Language Models for software vulnerability detection — papers across function-level, repository-level, agentic, and smart-contract detection, plus datasets, benchmarks, and surveys.

Prevent merging of malicious code in pull requests

Focused malicious code detection ruleset, with a high protection-to-noise ratio

AI-powered SAST scanner that finds auth bypass, IDOR, and logic bugs Semgrep/CodeQL miss. Free GitHub Action. Supports Python, JS/TS, Go, PHP, Ruby.

A deterministic verification layer for AI systems. QWED verifies AI outputs using mathematics, symbolic reasoning, and formal methods (Z3, SMT, SymPy), creating an auditable trust boundary for agentic AI. Not generation. Verification.

OpenVul: An Open-Source Post-Training Framework for LLM-Based Vulnerability Detection

Codeaudit - Modern Python source code security analyzer based on distrust.

Detect and patch vulnerabilities in AI-generated Python code — VS Code extension

AI code generation and improvement

Contexi let you interact with entire codebase or data with context using a local LLM on your system.

GoBfuscator is a professional-grade obfuscation tool specifically designed for Go (Golang) source code. It provides multiple layers of protection to make reverse engineering difficult while maintaining 100% runtime functionality.

Adversarial AI Coding: Self-Play Sparring, Offense Meets Defense — Making AI Write Secure Code

🔍 CodeVista — AI-powered code analysis & visualization tool. Understand complex codebases instantly. Dependency graphs, architecture insights & quality metrics.

Scan code for invisible bidirectional Unicode characters (Trojan Source attack prevention, CVE-2021-42574)

PyGitGuard is a Git security scanner designed to prevent accidental commits of sensitive data by scanning for:

Universal security scanning skill for AI agents - finds hardcoded secrets, API keys, and vulnerabilities in any codebase. 44 patterns validated against GitLeaks, OWASP Top 10 mapping, Markdown/SARIF/JSON reports. Works across Claude Code, Cursor, Windsurf, and any agentic platform.

SAST Scanner Modified - Fully open-source SAST scanner supporting a range of languages and frameworks. Integrates with major CI pipelines and IDE such as Azure DevOps, Google CloudBuild, VS Code and Visual Studio. No server required!

Static Python code vulnerability scanner powered by LLMs.

White-box AI code security review for Claude/Codex: offline scanner, review packs, SARIF, and report merging.

Calculate context-aware confidence scores for security findings. Prioritize vulnerabilities based on actual exploitability in your codebase.