AigisSAST v0.5.0

Full Changelog: v0.4.0...v0.5.0

AigisSAST v0.4.0

Clickable links in every report.

pip install -U aigis-sast

• scan: each finding links to the exact file#line on the current commit
• history: each finding links to the commit that introduced the secret
• links in text, JSON (url / commit_url) and Markdown, resolved from the git remote

AigisSAST v0.3.0

Precision release: far fewer false positives, now on PyPI.

pip install aigis-sast

Tested on 126 public AI-generated repos: AIG002 findings dropped from 2012 to 138 after manual review, with no real secrets lost.

• Test files and fixtures (tests/, conftest.py, .test.ts, test-.js): only real-format tokens and private keys are reported
• Lock files at repo root (pnpm-lock.yaml, uv.lock, ...) are excluded
• Placeholders: NOT_SET, BOT_TOKEN, your-key-here, env(...), ${...}, versions, CI words (inherit, write)
• Secret names: camelCase support; hashed_password, pad_token, *_EXPIRE_MINUTES, ACCESS_TOKEN_KEY etc. no longer flagged
• i18n/locale files skipped, sops ENC[...] values skipped
• Private keys: docs/placeholder examples ignored, real keys (incl. commented-out) still caught
• AIG003: local dev defaults (postgres:postgres@localhost) and example hosts skipped
• AIG010: f-strings with only placeholders/table names are not SQL injection
• AIG018: md5/sha1 for cache keys, checksums and content hashes ignored
• AIG021: auth-aware: include_router(dependencies=...), auth middleware, auth checks in the handler body, public routes (/login, /webhook, /health)
• AIG031: static innerHTML strings ignored
• 34 new regression tests (102 total)

uses: jasperBLCK/AigisSAST@v0.3.0

AigisSAST v0.2.0

AigisSAST now fixes what it finds.

• aigis fix: auto-fix safe cases. Hardcoded keys move to .env (+ .env.example, .gitignore), verify=False → True, yaml.load → yaml.safe_load, random → secrets for tokens/OTP, debug off, DB ports bound to 127.0.0.1. Use --dry-run to preview the diff.
• aigis history: scans the whole git history for secrets that were "deleted" but are still in old commits. Shows commit, date and whether the key is still in code. Keys are masked.
• aigis badge: security grade badge (SVG or shields.io URL) for your README.

pip install git+https://github.com/jasperBLCK/AigisSAST@v0.2.0
aigis scan . && aigis fix --dry-run && aigis history

AigisSAST v0.1.0

First public release of AigisSAST, a security scanner for AI-generated code.

• 21 rules: hardcoded tokens & passwords, SQL/shell injection, eval, unsafe deserialization, JWT without signature check, CORS *, debug=True, verify=False, XSS, exposed DB ports, root containers and more
• Python AST analysis + regex checks for JS/TS, YAML, Dockerfile, docker-compose
• Plain-language explanations and ready-to-use fixes (in Russian)
• Output: text, JSON, SARIF (GitHub Code Scanning), Markdown
• GitHub Action + pre-commit hook
• Optional AI fixes via any OpenAI-compatible API (secrets are never sent)
• Zero dependencies, Python 3.9+

pip install git+https://github.com/jasperBLCK/AigisSAST
aigis scan .