CodeDrift – static analysis for AI-generated code
Hi HN, I built *CodeDrift*, a CLI tool that detects bugs commonly introduced by AI coding assistants like Copilot, Cursor and ChatGPT. Over the last year I noticed that AI tools often generate code that compiles correctly, passes linting and looks reasonable in code review but still contains subtle issues. Some common examples I kept seeing: * async `forEach` loops that never await promises * missing authorization checks (IDOR) * hallucinated dependencies that don’t exist * stack traces leaking sensitive information * request data used without validation These bugs often slip past ESLint,…
What it does
In the maker’s words, at launch
Hi HN, I built *CodeDrift*, a CLI tool that detects bugs commonly introduced by AI coding assistants like Copilot, Cursor and ChatGPT. Over the last year I noticed that AI tools often generate code that compiles correctly, passes linting and looks reasonable in code review but still contains subtle issues. Some common examples I kept seeing: * async `forEach` loops that never await promises * missing authorization checks (IDOR) * hallucinated dependencies that don’t exist * stack traces leaking sensitive information * request data used without validation These bugs often slip past ESLint, TypeScript and even human reviewers because the code looks correct. CodeDrift parses the code using the TypeScript compiler API and runs a set of detectors looking for these patterns. Example: ``` async function syncProducts(items) { items.forEach(async (item) => { await updateStock(item.id); }); } ``` CodeDrift output: ``` CRITICAL: async forEach does not await promises Fix: use Promise.all or a for...of loop ``` Another example it detects: ``` Database query using user-supplied ID without authorization check → potential IDOR vulnerability ``` The goal isn’t to replace tools like ESLint or TypeScript, or security scanners like Snyk. It’s meant to act as a safety layer for code generated with AI assistants. The tool runs locally, requires no cloud access, and can be tried with: ``` npx codedrift ``` I’d love feedback from developers who are using AI coding tools in production.
Does the same job
all alternatives →- SASpaghettify – A VSCode Extension to make your code worse with AI2023 · spaghettify.dev · ▲323
Recently, I saw Github Next Code Brushes (https://githubnext.com/projects/code-brushes) which is a VSCode extension that can use AI to do things like make your code more readable, add types, etc. This inspired me: what if there was an extension that could use AI to make your code worse as well? Meet Spaghettify. An extension I developed that can do things like: - Obscure your code - Introduce a bug - Make the variable names way too descriptive - Use nonsymmetrical whitespace - Add irrelevant/rambling comments - Document the code with emoji - Document the code in any…
DevSwat AST- visualizer with analyzer Jul 2026 · ▲81Turn codebases into interactive maps, graphs, and governance
- CACodeium – a free, fast AI codegen extension2022 · codeium.com · ▲86
I'm Varun, CEO of Exafunction, and we just released Codeium to open up access of generative AI to all developers for free. In the spirit of Show HN, we created a playground version for anyone to try this tech in the browser (click Try in Browser)! We have built scalable, low-latency ML infra for many top AI companies in the past, and we are excited to leverage that tech into a product that we, as developers, would love. We hope that you do too, and we would appreciate any feedback that this community has for us!
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 16d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 26d ago · cactuscompute.com
Launched alongside, March 2026
the whole month →
Switch from ChatGPT to Claude with import memory feature
AI · Mar 2026 · claude.com
