ZenVeil

ZenVeil is a security scanner built for one specific situation, which is code an AI wrote. The headline on the site is "AI writes your code. ZenVeil secures it." and the argument underneath it is that traditional scanners were designed for the mistakes humans make, while assistants like GitHub Copilot, Cursor, and Claude Code fail in their own recognisable patterns. It runs as a CLI, a GitHub Action, or through a dashboard, and when it finds something it can open the fix as a pull request rather than handing you a report to work through. The framing is worth taking seriously, because the volume of code a small team ships has gone up sharply while the number of people reading it carefully has not.

The failure patterns it names are concrete, and that specificity is most of the pitch. Copilot autocompletes hardcoded secrets, because it learned from repositories full of them. Cursor's multi-file edits leave auth checks inconsistent, since a change applied across several files doesn't always land everywhere it should. Claude Code's long sessions pull in outdated dependencies with known vulnerabilities, because a model working from memory reaches for the version it knows. None of these are exotic. They're the predictable seams of letting a model write at speed, and they slip through review precisely because the code looks fine. Generated code tends to be well formatted and plausibly structured, which is exactly what disarms a reviewer skimming a large diff on a Friday.

What it actually scans for covers the usual high-severity ground with an AI-shaped emphasis. It detects hardcoded secrets against more than 200 patterns including AWS keys, JWT tokens, and API credentials. It flags routes missing authorization middleware, which is the inconsistent-auth problem showing up as a real hole. It catches tokens parked in browser localStorage, where any cross-site scripting bug turns into account takeover. It checks the dependency tree against CVE data for supply chain issues, and looks for exposed source maps and dependency confusion risk. Findings map to the OWASP Top 10, so the output lands in a vocabulary security teams and auditors already use.

Speed is treated as a feature rather than a footnote, and the reasoning holds up. The site cites roughly 47 files scanned in 22 seconds and a target of catching what's specific to each assistant in under 30 seconds. A scanner that takes ten minutes gets skipped, then disabled, then forgotten. One that finishes before you've switched tabs can sit in the loop where AI-generated code is actually produced, which is the only place it does any good. Installation is a single pip command, and there's a GitHub Actions workflow so the same check runs on every pull request without anyone remembering to trigger it.

The remediation side is what separates it from a linter that shouts. Rather than printing a list of file paths and line numbers, it can generate a pull request with the fix already written, which puts the finding into a workflow developers already respond to. Paid tiers add AI-generated explanations alongside the fixes, so a junior developer learns why localStorage was the wrong place for that token instead of just merging a diff they don't understand. That matters more as teams lean harder on generated code, because the knowledge gap widens exactly when the volume of code goes up.

It's aimed at developers and small teams shipping with AI assistants daily, and at security engineers who've noticed their existing tooling wasn't tuned for this. If your team went from writing every line to reviewing generated pull requests, the review bottleneck moved and your scanner probably didn't move with it. Reviewers who once read every line now skim diffs they didn't write, in volumes nobody was reading before, and what slips through is exactly the quiet structural problem this looks for. The narrow focus cuts both ways. ZenVeil isn't trying to be a full application security platform, and if you need deep static analysis across a large legacy codebase you'll still want a heavier tool beside it. What it does is cover the specific gap that opened when assistants started writing production code, which is a gap most teams didn't have two years ago and can't really ignore now.

Access is freemium and the free tier is genuinely usable for evaluation, with 3 public repository scans an hour, no credit card, and basic findings included. Pro is $19 a month for unlimited scans, private repositories, and AI-powered explanations and fixes. Team is $59 a month for up to 5 members with compliance reports. Enterprise is custom priced and adds SSO, audit logs, and on-premise deployment. The product launched on Product Hunt, the dashboard is live, and the published contact is security@zenveil.dev.