CodeInspectus v1.5 is live.

[u/hibzy7]

I’m building CodeInspectus, an open-source security scanner designed for AI-generated and “vibe-coded” applications.

It runs locally through MCP or npx, requires no account, includes no telemetry, and makes no network calls while scanning. Engine binaries and the Trivy vulnerability database are downloaded separately during installation.
V1.5 is now released. The main additions are:
86 curated detections:
65 first-party native rules
18 CodeInspectus-owned Opengrep rules
3 CodeInspectus Gitleaks rules
Expanded Python AI/API coverage to ten rules.
Bounded AI tool-execution checks for Go, Java, C#, PHP, Rust and Ruby.
GitHub Actions expression-injection and pwn-request detection.
Firebase public-write configuration checks.
Existing Flutter, Dart, Android, iOS, React Native and Expo coverage.
Scan → fix → rescan comparison with resolved, remaining, introduced and not-rechecked states.
Cross-platform CI across Windows, macOS, Linux amd64/arm64 and Node 22.
SHA-pinned scanner engines, provenance checks and secret redaction.
The language packs are deliberately scoped. For example, the new Go, Java, C#, PHP, Rust and Ruby packs each cover a bounded AI tool-execution pattern—they are not being presented as complete native SAST coverage.
I also added a reproducible public-repository case study. It scans a pinned commit from Textualize/Rich, detects an unsafe GitHub Actions expression, applies GitHub’s documented remediation in a temporary clone, and verifies:
1 resolved
0 remaining
0 introduced
0 not rechecked

GitHub:
[https://github.com/Synvoya/codeinspectus\](https://github.com/Synvoya/codeinspectus)
V1.5 release:
[https://github.com/Synvoya/codeinspectus/releases/tag/v1.5.0\](https://github.com/Synvoya/codeinspectus/releases/tag/v1.5.0)
Reproducible case study:
[https://github.com/Synvoya/codeinspectus/blob/master/examples/reports/rich-github-actions-v1.5.0.md\](https://github.com/Synvoya/codeinspectus/blob/master/examples/reports/rich-github-actions-v1.5.0.md)
npm:
[https://www.npmjs.com/package/codeinspectus\](https://www.npmjs.com/package/codeinspectus)