AI code audit

No proof, no report

Scanner noise traces to one habit: tools report conjecture. This audit works the other way. Candidates emerge from the pattern sweep as unproven leads, and a validation stage walks each one through the scanned tree — entry point, propagation, sink — checking that the code at every claimed file and line actually says what the finding claims. Any lead that fails the walk is dropped; what remains is counted as unverified and shown as a tally, never dressed up as findings. Severity comes from the proven path, not from a maybe. The report caps at five: strongest evidence leading, ordered by severity. If validation proves only two findings, you get two — not three filler warnings padding the page.

A report you can walk, not a wall of warnings

Each reported finding is an attack path, presented in order: the entry point an attacker controls, the steps the dangerous input travels, and the sink that does damage. Every step is pinned to a file and a line range, with a verbatim snippet of your code beside it — a 3-line cap, secrets masked — and a one-line note naming the role that step plays in the chain. The finding closes with the impact at the sink and a fix hint. The report is built for checking, not browsing: open the file, jump to the claimed range, and the claim is already there in your code. It is assisted analysis, not an oracle — review the path before you act on it.

Coordination: drift uncoordinated AI coding leaves

Uncoordinated agents rewrite a feature twice under different names, leave stale copies alive, skip tests, collide migration numbers. Detection here is deterministic, before any explanation gets written: near-identical function bodies cluster across folders; orphaned exports, duplicate migration numbers, schema–migration drift, unconditionally skipped tests, TODO stubs, hardcoded mock data left on production paths — every flag carries file, line, masked snippet. Severity stays advisory (medium, low — never critical); honest tallies count whatever failed verification or hit the cap. Such drift marks uncoordinated agents; JoeFlow — flows scripting their work, working rules — provides the fix.

AI code audit FAQ

Is the AI code audit free?

Yes — auditing a public repository requires no account. The JoeFlow handoff is there when you prefer the findings tracked as work, with owners, statuses and a board, instead of living inside a local file.

What turns a suspicion into a reported finding?

A complete attack path that clears validation: entry point, propagation and sink, each pinned to a file and a line range, with a snippet checked against the scanned tree. If any step fails to verify, the candidate joins the unverified count — it is never reported as a finding.

Does the audit run my code or attack my servers?

Never. The audit reads source files and reasons over them; it does not execute scanned code and does not send traffic to any running system. That constraint is deliberate — it is what keeps the tool safe to point at any repository.

Where does my code go when the scan finishes?

The temporary copy of the tree is deleted when the scan finishes. What stays is the finding set only — file paths, line ranges, the rule family and a masked snippet capped at three — retained for 30 days so you can retrieve the report.

How do coordination findings differ?

Security findings need proven attack paths; coordination findings flag drift left by uncoordinated AI coding — duplicated implementations, dead code, competing libraries, skipped tests, leftover stubs, migration drift. Advisory only (medium, low — never critical), deterministic detection, cluster grouping: each cluster ships as a single fix.

Why coordinate agents in JoeFlow?

Coordination drift signals process failure: multiple AI sessions edited a repository without shared plans. JoeFlow's handoff lands a remediation project covering every cluster, while JoeFlow itself coordinates agents: flows scripting work, review, assignment. The next feature ships correctly the first time.