// ai security code reviewer
Find the vulnerabilities before attackers do.
Paste a snippet and get a defensive security review — the risky lines, why they're dangerous, and how to fix them. Powered by Claude, with a built-in heuristic scanner when AI is offline. Your code is analysed in memory only and never stored.
What it checks for
- Injection sinks — SQL/command/code execution from untrusted input (CWE-89/77/95).
- Cross-site scripting — unescaped output of user data (CWE-79).
- Secrets in code — hardcoded keys, passwords, and tokens (CWE-798).
- Weak crypto & randomness — MD5/SHA-1 for passwords, predictable tokens (CWE-327/330).
- Unsafe deserialization, SSRF, path traversal, and disabled TLS verification.
Frequently asked questions
What kinds of vulnerabilities does it find?
It flags common classes such as injection, insecure deserialization, hardcoded secrets, weak crypto, missing input validation, and unsafe configuration, with severity and remediation guidance.
Which languages are supported?
It reviews most mainstream languages by reasoning over the pasted snippet; results are strongest for self-contained functions and clearly scoped files.
Is my code stored?
No. Code is analyzed for your session and is not retained or used for training. Avoid pasting production secrets — rotate anything you share anywhere.
Does it replace a full security audit?
No. It is a fast first-pass defensive review to catch obvious issues early; pair it with dependency scanning, tests, and human review for production code.
入力データの取り扱い
処理方法
Pasted code is reviewed for this one request. NeoShield does not store your source, and no snippet is retained after the response is rendered. ご送信いただいた内容は、この1回の分析のためにAIプロバイダーへ送信されます。モデルの学習には使用されません。
保持しないもの
- オフライン解析ツールへの入力は保存もログ記録もされません。
- モデルが生成したコードをNeoShieldのサーバー上で実行することはありません。
- 貼り付けられた認証情報、トークン、ペイロードがこれらのツールによってディスクに書き込まれることはありません。
詳細は信頼性ページおよびプライバシーポリシーをご覧ください。
このツールが確認すること・確認しないこと
確認すること
- Injection classes: SQL, command, template, and unsafe deserialization.
- Broken authentication and authorization logic, including missing ownership checks.
- Hard-coded secrets, API keys, and credentials committed into source.
- Weak cryptography and predictable randomness (CWE-327 / CWE-330).
- SSRF, path traversal, and disabled TLS verification.
確認しないこと
- It does not execute your code — analysis is entirely static.
- It does not resolve imports or analyze code you did not paste.
- It does not replace a full SAST pipeline or a manual code audit.
- It cannot prove code is free of vulnerabilities; absence of findings is not assurance.
仕組み
- The snippet is sent to an AI reviewer prompt scoped to defensive analysis and mapped to CWE classes.
- Findings are returned with a severity, the specific line context, and a concrete fix.
- Model output is treated as untrusted data: it is displayed for your review and never executed on NeoShield servers.
関連ツール
もっと多くの利用枠が必要ですか
The Free plan includes a limited number of AI analyses per day on each tool. Proにすると、すべてのAIツールで1日あたり・1か月あたりの利用枠が増え、上位モジュールも使えるようになります。前払いのパスなので期間満了で自動的に終了し、自動更新はありません。