DEV Community

문근영
문근영

Posted on

Your AI wrote half your codebase. Who checked it for leaked keys and license traps?

#showdev #security #opensource #ai

Disclosure: I'm the founder of TechDD.

A lot of production code is now written by Cursor, Claude and Copilot. It ships fast — but nobody on the team really knows what's inside it.

  • AI assistants happily hardcode API keys and passwords,
  • suggest library versions with publicly known vulnerabilities,
  • and paste in open-source snippets of unknown origin — sometimes under licenses like GPL that can force you to disclose your source in a commercial product. Neither the developer nor the CEO usually knows.

These issues tend to surface at the worst moment: investor due diligence, an enterprise deal, or a customer's security review.

So from Oct 19 to Oct 23 (KST) we're running a review program: pick one scan, run it on your own code, write an honest review, and pay nothing.

  • Security Triple Check — leaked secrets, vulnerable dependencies and code security flaws, with file- and line-level evidence and fix guidance.
  • Open Source License Report — licenses that could force source disclosure or damages, plus an SBOM.

🔒 Your source code stays private

We know handing over your company's source code is sensitive. The TechDD engine runs only inside an isolated, closed network.

  • Scans run only in an isolated environment, and your source code is automatically deleted once the report is generated.
  • Your code is never sent to external AI or any third-party service.
  • Analysis uses proven tooling that enterprise security teams rely on — Gitleaks, Semgrep, Trivy/Grype and ScanCode.

How it works

  1. Join with PayPal — an authorization hold for the regular price ($119). Nothing is charged today.
  2. Submit your source (ZIP or repo URL) within 7 days; the report arrives within 24 hours. Dependency/build folders are excluded automatically, so you can zip the whole project.
  3. Write a review within 3 days of the report → the hold is released, you pay $0.

Please read before joining

  • ⚠️ If no review is submitted within 10 days of joining, the full price is charged.
  • Entries close Oct 23, 23:59 KST. One entry per company.
  • Positive or negative reviews both count — we only check that a complete review was submitted.
  • By joining you agree we may name your company and CEO as a customer reference.
  • Code is analyzed in an isolated environment, never sent to external AI, and deleted afterwards.

👉 Join: https://dd.knowverse.net/en/review-event?utm_source=devto&utm_medium=blog&utm_campaign=review-2026

Blunt feedback is exactly what we're after — happy to answer questions in the comments.

Top comments (0)