The latest articles on DEV Community by Théo CLEMENT (@neo-degen). https://dev.to/neo-degen https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4232887%2Fde49883d-456d-40d3-9c14-589ac32a0157.png https://dev.to/neo-degen en Théo CLEMENT Sat, 07 Nov 2026 23:21:22 +0000 https://dev.to/neo-degen/i-built-a-free-security-checker-for-ai-generated-apps-5259 https://dev.to/neo-degen/i-built-a-free-security-checker-for-ai-generated-apps-5259 <p>Hi, I'm Théo. I'm a self-taught developer and I build most of my projects with AI tools like Claude Code.</p> <p>AI tools are great at making an app that works. But "it works" is not the same as "it's safe". When I looked at my own projects, and at a lot of AI-generated code shared online, I kept seeing the same mistakes:</p> <ul> <li>an OpenAI, Anthropic or Stripe key written directly in the code, or still in the git history</li> <li>a secret key put in a <code>NEXT_PUBLIC_</code> or <code>VITE_</code> variable, so it ships to the browser</li> <li>Supabase tables without Row Level Security, or with <code>using (true)</code> policies</li> <li>Firebase rules that let anyone write</li> <li>API routes that call a paid AI API or use the service_role key without checking who is calling</li> <li>a committed <code>.env</code> file</li> </ul> <p>So I built <strong>Garde-Fou</strong> (French for "guardrail"). It's a small CLI that checks for these problems before you ship.</p> <h2> How to try it </h2> <p>In your project folder:<br> </p> <div class="highlight js-code-highlight"> <pre class="highlight shell"><code>npx @gardefou/cli </code></pre> </div> <p>You get a score out of 100 and a list of problems, most serious first. For each one: why it's dangerous, how to fix it, and a prompt you can paste into Cursor, Lovable, Bolt or Claude Code so it fixes it for you. <code>--html</code> gives you a report page instead.</p> <h2> A few choices I made </h2> <ul> <li> <strong>It runs on your machine.</strong> It doesn't change your files and doesn't send your code anywhere.</li> <li> <strong>Detection doesn't use AI.</strong> The rules are deterministic. I'd rather miss something than show false alarms.</li> <li> <strong>The only network call</strong> is the dependency check on OSV.dev (package names and versions only). <code>--offline</code> turns it off.</li> <li>There's also an MCP server (<code>npx @gardefou/cli mcp</code>) so an AI agent can run the scan itself, and a GitHub Action for pull requests.</li> </ul> <h2> It's early </h2> <p>It's free and open source (MIT). It only covers the mistakes I see most often, and I'm sure it has gaps and false positives.</p> <p>I'd really like your feedback:</p> <ul> <li>What did it miss in your project?</li> <li>Did it flag something that was actually fine?</li> <li>What check would you add first?</li> </ul> <p>GitHub: <a href="https://github.com/theojoyerclement-crypto/garde-fou" rel="noopener noreferrer">https://github.com/theojoyerclement-crypto/garde-fou</a></p> <p>Thanks for reading.</p> <p><em>English is not my first language, so I used AI to help me write this post.</em></p> security opensource vibecoding webdev