Deterministic Security for AI-Generated Codebases

Detect dependency slopsquatting, client-side secret bleeds, and unverified payment webhooks before production. Mathematical AST proof with zero API tokens.

Zero-config execution

$npx @kennedy1020/vibe-shield scan .

Open Workbench

Sub-2s Run

Local CLI and CI runner execution

Zero Remote Egress

Code never leaves your environment

Binary Exit Code

exit 0 for pass, exit 1 for block

vibe-shield audit

1.14s

SafeKen VibeShield v1.1.3

Probing package.json against npm registry...

CRITICAL [dependency-hallucination]: 1 issue found

• package.json:18

Package "react-use-stream-ai-fake-package-9912" does not exist on npm (HTTP 404)

Slopsquatting risk: Attacker can publish this package to hijack build

──────────────────────────────────────

Audit failed with exit code 1PID 4821

Interactive Verification Workbench

Test Your Code Against Deterministic Rules

Paste source components, drop a package.json or requirements.txt, and inspect exact AST & registry proofs in real time.

Scenarios:

Drag & drop file supported13 lines

Target engine:AST Boundary Ruleset (5 rules)

•Press Ctrl/⌘ + Enter to run

Deterministic Terminal Output

Exact Terminal Output in Under Two Seconds

Inspect real AST and manifest outputs for the top four vulnerability patterns.

vibe-shield scan|1.14s|exit 1

Catches AI-hallucinated packages before attackers publish them to public registries

$npx @kennedy1020/vibe-shield scan .

SafeKen VibeShield v1.1.3

Auditing: C:\Users\user\Projects\nextjs-saas-app

Probing dependencies against npm and PyPI registries...

─────────────────────────────────────────────────────────────────

CRITICAL [dependency-hallucination]: 1 issue found

• package.json:18

Package "react-use-stream-ai-fake-package-9912" does not exist on npm

Slopsquatting Hazard: Code generated by LLM imports an unregistered package.

Remediation: Remove the hallucinated package before a malicious actor claims it.

─────────────────────────────────────────────────────────────────

Summary: 1 critical | 0 high | 0 warnings | 1 target failed

Audit failed with exit code 1

Engine Architecture

Why Deterministic Engines Beat LLM Wrappers

AI code assistants make probabilistic errors. Auditing them with another LLM introduces hallucinations checking hallucinations. SafeKen replaces prompt guesswork with mathematical certainty.

Analysis Metric

Probabilistic LLM Wrappers

SafeKen VibeShield Engine

Verification Engine

Probabilistic guess inferred from context and prompt drift

Deterministic AST syntax traversal and semantic rule checks

Slopsquatting Audit

Guesses whether a package name sounds authentic

Direct HTTP HEAD query verifying 404 status on npm and PyPI registries

CI/CD Predictability

Unstable; non-deterministic outputs across model updates

100% reproducible; identical inputs guarantee identical exit codes

Audit Execution Time

5–30s latency waiting for remote LLM token streams

Sub-2 second execution directly in local shell or GitHub runner

Infrastructure Cost

Variable per-token API billing and third-party rate limits

$0 API costs; completely self-contained binary

Source Code Privacy

Pipes private application logic to third-party model servers

Zero remote egress; source code never leaves your machine

Deterministic Ground Truth

“You cannot fight hallucinations with more hallucinations. Security is binary proof, not a prompt.”

exit 0|exit 1

SafeKen Cloud — Early Access

Automate SafeKen Across Your Entire Engineering Team

Continuous PR auditing, unverified webhook dynamic simulation, and centralized enterprise compliance dashboards.