Prbl is a security scanner built for AI-generated code — the 10–60% of your codebase you didn’t write, and probably didn’t audit.
The problem
The seam finding
89.2% human-written. The bug was in the other 10.8%.
create_blog_posts.py:22 — password='password123'A repo that looked like clean, senior Python. One Cursor-generated migration file. That file had a hardcoded credential that would have shipped to production.
SQL injection
A booking platform's auth controller. Login bypass. Real users.
auth.js:12 — SQL injection via string concatenationThe AI wrote a fast login endpoint. It also wrote a classic 1990s-era SQL injection. The rest of the codebase used parameterized queries correctly.
The fallback secret
A payment API. JWT secret falls back in production.
jwt.js:3 — process.env.JWT_SECRET || 'default_secret'Every deployment where the env var is missing signs tokens with a public, predictable key. Every token ever issued can be forged.
How it works
Scan
Prbl detects AI-generated files and scans them for the vulnerability classes AI tools produce systematically — hardcoded secrets, injection, missing auth, weak crypto.
Baseline
Behavioral tests are generated for every function before anything is touched. These become the contract that every fix must satisfy.
Fix
The rewriter applies the minimal fix, validates that behavior is preserved against the baseline, then shows you a clean diff. You approve before anything merges.
Verify
Rescan confirms zero findings. The baseline tests still pass. Nothing ships broken.
Built for AI-generated code
General-purpose security scanners weren’t built to ask one specific question: did an AI tool generate this code, and does it have the gaps AI tools leave behind?
Three things Prbl checks that general scanners typically don’t:
Missing access control on AI-scaffolded routes
// AI-generated — no auth check
app.delete('/api/users/:id', async (req, res) => {
await db.users.delete(req.params.id)
res.json({ deleted: true })
})AI coding tools are excellent at generating working CRUD endpoints and often forget the authentication check entirely. General SAST tools check for injection and crypto issues — most don't check whether your routes require auth at all.
Fallback secrets in environment variable lookups
// Becomes 'dev-secret' in production
// if JWT_SECRET was never set
const secret = process.env.JWT_SECRET || 'dev-secret'process.env.JWT_SECRET || 'dev-secret' works perfectly in development and becomes a public, predictable production secret the moment someone deploys without setting the variable. This pattern is extremely common in AI-generated config code.
Timing-unsafe webhook signature checks
// Vulnerable to timing attacks
if (req.headers['x-signature'] === computed) {
processWebhook(req.body)
}AI tools frequently generate signature === computed instead of a constant-time comparison for webhook verification — a subtle but real authentication bypass vector.
Run Prbl alongside your existing tools. It’s not a replacement — it’s the layer that looks specifically for what AI tools get wrong.
Pricing
Pro
Team
Get started today