GuardScan is a 3-layer security scanner for AI agent code by MerchantGuard. It checks for 102 vulnerability patterns across 17 categories including secrets exposure, prompt injection, PCI-DSS violations, and data exfiltration. Results include a score (0-100), severity ratings, and fix suggestions.

How does GuardScan work?

GuardScan runs three analysis layers: (1) Static pattern matching with 102 regex patterns across 17 security categories, (2) VirusTotal hash checking against 90+ antivirus engines, and (3) LLM semantic analysis using Gemini 2.5 Flash to catch logic flaws that regex cannot detect. Results are returned in under 15 seconds.

What categories does GuardScan check?

GuardScan checks 17 categories: secrets exposure, authentication flaws, XSS, injection attacks, configuration issues, rate limiting, PCI-DSS compliance, GDPR/compliance, cryptography, file access, malware signatures, prompt injection, data exfiltration, tool abuse, autonomy abuse, skill manifest issues, and code obfuscation.

Yes, the basic static scan is completely free with no signup required. Paste your code or enter a GitHub URL and get instant results. Deep scan (adding VirusTotal and LLM analysis) is available on paid plans.

How is GuardScan different from Snyk or SonarQube?

GuardScan is purpose-built for AI agent code. Unlike Snyk or SonarQube, it includes prompt injection detection, PCI-DSS payment patterns, tool abuse checking, autonomy abuse detection, and LLM-as-Judge semantic analysis. Traditional scanners miss these AI-specific vulnerabilities entirely.

Can I scan a GitHub repository?

Yes. Enter any public GitHub URL and GuardScan will fetch the repository files and scan them automatically. Both the web interface and the REST API support GitHub repo scanning.

How is the security score calculated?

GuardScan uses a half-life scoring model: score = 100 * (0.5 ^ (deductions/80)). Critical findings deduct 40 points, high deducts 20, medium deducts 10, and low deducts 5. Scores above 90 are SAFE, 70-89 is CAUTION, 40-69 is RISKY, and below 40 is DANGEROUS.

 _____ _   _  ___  ____________  _____ _____   ___   _   _
|  __ \ | | |/ _ \ | ___ \  _  \/  ___/  __ \ / _ \ | \ | |
| |  \/ | | / /_\ \| |_/ / | | |\ `--.| /  \// /_\ \|  \| |
| | __| | | |  _  ||    /| | | | `--. \ |    |  _  || . ` |
| |_\ \ |_| | | | || |\ \| |/ / /\__/ / \__/\| | | || |\  |
 \____/\___/\_| |_/\_| \_|___/  \____/ \____/\_| |_/\_| \_/

9/10 AI-generated apps leak API keys in plain sight

GuardScan™ Security Scanner

Vibe coders, scan your AI code for AI-ready fixes.

Built with Claude, Cursor, Replit, or Copilot? Get a fix file that tells your AI assistant exactly how to patch every vulnerability.

102

Security & Compliance Patterns

<10s

Scan Time

Free

Forever

1-Click

Fix File

Public GitHub Repository

Public repos only. Sign in with GitHub above to scan private repositories.

By scanning, you agree to our Terms of Service.

Not sure what to expect? Try a demo:

See the difference between secure and risky AI-generated code

AI-Ready Fix Prompts

You built it with AI. Fix it with AI.

Scan finds issues

SQL injection, XSS, exposed secrets — we catch it all

Get the fix prompt

One-click download with file, line, and exact fix instructions

Paste to your AI

Claude, Cursor, ChatGPT, Gemini — they all understand it

GUARDSCAN_FIXES.mdCopy & Paste Ready

# Security Fix Guide for my-startup-app
Fix 5 security vulnerabilities in priority order.

2 Critical 2 High 1 Medium

---

## 1. Hardcoded Stripe Key (Critical)
src/services/stripe.ts:12

const STRIPE_KEY = 'sk_live_4eC39...'

const STRIPE_KEY = process.env.STRIPE_SECRET_KEY

---

## 2. SQL Injection (Critical)
src/db/users.ts:47

db.query(`SELECT * FROM users WHERE id = ${userId}`)

db.query('SELECT * FROM users WHERE id = $1', [userId])

---

*Just tell Claude: "Read GUARDSCAN_FIXES.md and fix all issues"*

What We Scan

🔑

Exposed Secrets

OpenAI, Anthropic, Stripe, AWS, Google API keys

💉

Code Injection

SQL, NoSQL, command injection, template injection

🔓

Auth Issues

Bypass vulnerabilities, weak JWT, missing auth

🎭

XSS & CSRF

Unsafe HTML rendering, innerHTML, script injection

🚫

Rate Limiting

Unprotected endpoints, brute force exposure

🌐

CORS & Headers

Wildcard origins, missing security headers

📦

Dependencies

Outdated packages, known CVEs

💲

Financial Compliance

PCI-DSS, card data exposure, payment security

What GuardScan™ Is (and Isn't)

What GuardScan™ IS

✓A quick first-pass security check for common vulnerabilities
✓Pattern-based detection for 99 known security issues across 17 categories
✓A helpful starting point before you ship
✓Great for catching obvious leaks (API keys, SQLi, XSS)

What GuardScan™ ISN't

✗A guarantee of security — no tool can promise that
✗A replacement for professional pentesting or security audits
✗Able to catch logic flaws, auth issues, or complex attacks
✗A full SAST tool — we're regex-based, not AST analysis

💡 Pro tip: Use GuardScan™ to catch the easy stuff, then get a real security audit before handling serious user data.

Disclaimer: GuardScan™ is provided "as is" for informational purposes only. It uses pattern matching and may miss vulnerabilities or produce false positives. A clean scan does not guarantee your code is secure. By using GuardScan™, you agree to our Terms of Service. For production apps, always conduct thorough security testing with qualified professionals.

Free forever. No signup required.

Built by MerchantGuard - AI-powered compliance for payment processors.

Need help with payment processing? We help merchants stay compliant. Ship fast. Ship safe.

Loading GuardScan™...

_____ _ _ ___ ____________ _____ _____ ___ _ _ | __ \ | | |/ _ \ | ___ \ _ \/ ___/ __ \ / _ \ | \ | | | | \/ | | / /_\ \| |_/ / | | |\ `--.| / \// /_\ \| \| | | | __| | | | _ || /| | | | `--. \ | | _ || . ` | | |_\ \ |_| | | | || |\ \| |/ / /\__/ / \__/\| | | || |\ | \____/\___/\_| |_/\_| \_|___/ \____/ \____/\_| |_/\_| \_/

# Security Fix Guide for my-startup-app Fix 5 security vulnerabilities in priority order. 2 Critical 2 High 1 Medium --- ## 1. Hardcoded Stripe Key (Critical) src/services/stripe.ts:12 const STRIPE_KEY = 'sk_live_4eC39...' const STRIPE_KEY = process.env.STRIPE_SECRET_KEY --- ## 2. SQL Injection (Critical) src/db/users.ts:47 db.query(`SELECT * FROM users WHERE id = ${userId}`) db.query('SELECT * FROM users WHERE id = $1', [userId]) --- *Just tell Claude: "Read GUARDSCAN_FIXES.md and fix all issues"*