A few weeks ago I wanted a simple way to quickly check code snippets for common security anti-patterns without uploading anything to a server.
So I built Secure Code Scanner — a completely free, client-side tool that runs 100% in your browser.
What’s included:
Code Scanner → Heuristic detection for XSS sinks, SQL concatenation, command injection, insecure deserialization, weak crypto, prototype pollution, and more
Context Playground → See how the same user input behaves differently in HTML body, attributes, URLs, headers, SQL, NoSQL, filenames, shell commands, and logs
CSP Builder → Generate a starting Content-Security-Policy with sensible defaults
Interactive Quiz → Test your understanding of common injection issues
Vulnerability Reference → Clear defensive principles (not just payload lists)
Everything stays in your browser. Nothing is sent to any server.
Try it here:
https://iosecure-code-scanner.site
I’d love feedback — especially if you find false positives/negatives in the scanner rules or have ideas for new checks.
If you find it useful, a share or star would mean a lot!
Top comments (0)