Free options cover three jobs for AI-generated code: checking dependencies against known vulnerabilities, checking how risky a project's habits are, and running static analysis on code. None covers all three well, and none replaces review. Pick one for each job, and write down what is left uncovered.
AI assistants write code quickly, and the output needs the same checks as any pull request. Two specific risks come up: insecure patterns in the code itself, and dependencies the assistant suggests.
Why check AI-written code at all?
A 2021 academic study, "Asleep at the Keyboard," prompted GitHub Copilot with 89 scenarios based on high-risk weakness types, producing 1,689 programs. The authors found approximately 40 percent of them to be vulnerable. The study is old, and tools have changed. It is still a useful reminder that models learn from code that includes mistakes.
OWASP's LLM09 entry on misinformation lists unsafe code generation as a risk, including suggestions of insecure or non-existent libraries. One of its scenarios describes attackers who find package names that coding assistants commonly invent, then publish malicious packages under those names. So the dependency a model names deserves the same suspicion as one from a stranger.
What do free tools cover?
1. Known vulnerabilities in dependencies
Two free options exist in this category.
- A public open source vulnerability database and scanner, such as the OSV project, which says it helps developers find known vulnerabilities in third-party open source dependencies that pose genuine risk to their application.
- A free in-browser scan. Safeguard's Gold scanner at gold.safeguard.sh/scan needs no login, parses your manifest or SBOM in your browser, and checks up to 100 dependencies against the Gold corpus.
Limits: these match package versions to known advisories. They do not catch a brand new malicious package with no advisory, and a plain match list does not say whether your code reaches the vulnerable function. Caps, such as the 100 dependency limit on the browser scan, also matter for large projects.
2. Project hygiene
The OpenSSF Scorecard project offers checks that assess open source projects for risky practices. You can run it on code you own through its GitHub Action, or from the command line on someone else's repository.
Limits: it scores practices of a project, such as how it is maintained. It does not read your application's code, and a high score is not a promise that a package is safe.
3. Static analysis of your own code
Many code hosts include built-in code scanning. GitHub's documentation describes it as analysis of the code in a repository for vulnerabilities and coding errors, with alerts on the repository. It also says scanning private repositories requires a license for its code security product, so check how your plan treats private code before relying on it. Code scanning accepts results in SARIF, an open standard, so tools from different sources can feed the same view.
Limits: static analysis finds patterns, and it produces false positives that someone must triage. It will not understand your business rules.
What do free options usually leave out?
- Policy enforcement across many teams, with approvals and recorded exceptions.
- Reachability, so you can set aside unreachable findings.
- Malicious package detection beyond known lists.
- Audit evidence in a form a compliance reviewer can use.
- Support and time to triage.
Those are the points where a paid or managed tool earns its place, if it does. Test any tool on your own repositories before you decide, and ask what it does when it cannot tell.
What to do
- Run a free dependency scan on one real project and write down the count of findings.
- Check every dependency an assistant adds against the registry yourself: publication date, download history, maintainer, and whether the name is exactly the one you intended.
- Turn on static analysis in the pull request pipeline in report-only mode first.
- Keep a short document listing what each free tool does not cover.
- Reduce risk at the source by asking assistants to prefer packages you already use, and review any new package in the same way as a human proposal.
- Reassess in a quarter, with numbers: findings fixed, time to fix, and what slipped through.
Quick check
Is AI-generated code less secure than human code?
The 2021 study found approximately 40 percent of 1,689 generated programs vulnerable in its scenarios. It does not compare against human code, and it covers one older tool, so treat it as a caution, not a ratio.
Can a free dependency scan catch a package an AI invented?
Not reliably. It matches names and versions to known advisories. A newly published malicious package may have none, so check new names by hand.
Sources
- Pearce et al., Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions
- OWASP Gen AI Security Project, LLM09:2025 Misinformation
- OSV, Introduction
- OpenSSF Scorecard
- GitHub Docs, About code scanning
- Gold Open Source, free dependency scan
Last reviewed: 18 October 2026.
