Show HN: Hallint – lint AI-generated code for security issues

██╗  ██╗ █████╗ ██╗     ██╗     ██╗███╗   ██╗████████╗
██║  ██║██╔══██╗██║     ██║     ██║████╗  ██║╚══██╔══╝
███████║███████║██║     ██║     ██║██╔██╗ ██║   ██║   
██╔══██║██╔══██║██║     ██║     ██║██║╚██╗██║   ██║   
██║  ██║██║  ██║███████╗███████╗██║██║ ╚████║   ██║   
╚═╝  ╚═╝╚═╝  ╚═╝╚══════╝╚══════╝╚═╝╚═╝  ╚═══╝   ╚═╝

Static analysis for AI-generated code. Catch the security holes Artificial Intelligence leave behind — before they reach production.

AI coding assistants (Copilot, Cursor, etc.) are fast, but they consistently introduce the same classes of bugs: hardcoded secrets, SQL injection, missing auth, unsafe eval. hallint catches them.

npm install @asyncinnovator/hallint

Or run without installing:

npx @asyncinnovator/hallint-cli ./src

Requirements: Node.js >= 18

npx @asyncinnovator/hallint-cli ./src
npx @asyncinnovator/hallint-cli "./src/**/*.ts"
npx @asyncinnovator/hallint-cli ./src --min-severity high
npx @asyncinnovator/hallint-cli ./src --rules all
npx @asyncinnovator/hallint-cli ./src --no-color

import { scan } from '@asyncinnovator/hallint'

const result = await scan({
  files: ['./src/**/*.ts'],
})

result.findings.forEach(f => {
  console.log(`${f.severity} [${f.ruleId}] ${f.filePath}:${f.line}`)
  console.log(`  ${f.message}`)
  console.log(`  fix: ${f.fix}`)
})
js
const result = await scan({
  files: ['./src/**/*.ts'],
  rules: 'recommended',
  minSeverity: 'high',
  ignore: ['**/node_modules/**', '**/dist/**'],
})
js
import { scanSource } from '@asyncinnovator/hallint'

const source = `const apiKey = "sk-abc123def456ghi789jk"`

const findings = scanSource(source, 'example.ts')

findings.forEach(f => console.log(f.ruleId, f.message))
{
  findings: Finding[]       // all issues found
  scannedFiles: string[]    // list of files scanned
  durationMs: number        // time taken
  summary: {                // count per severity
    critical: number
    high: number
    medium: number
    low: number
    info: number
  }
}
{
  ruleId: string        // e.g. "hardcoded-secret"
  severity: string      // "critical" | "high" | "medium" | "low" | "info"
  message: string       // human-readable description
  fix: string           // suggested fix
  filePath: string      // absolute path to the file
  line: number          // line number
  snippet: string       // the offending line of code
}

Create a hallint.config.ts

at your project root:

import type { ScanConfig } from '@asyncinnovator/hallint'

export default {
  rules: 'recommended',
  minSeverity: 'medium',
  ignore: [
    '**/node_modules/**',
    '**/dist/**',
    '**/*.test.ts',
  ],
} satisfies Omit<ScanConfig, 'files'>

Add hallint as a PR gate — it exits with code 1

on any critical or high finding:

name: hallint

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  hallint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - run: npx @asyncinnovator/hallint-cli ./src --min-severity high

Install husky:

npm install --save-dev husky
npx husky init
echo "npx @asyncinnovator/hallint-cli ./src --min-severity high" > .husky/pre-commit

Contributions are welcome. Each rule is a single file (~30 lines) with a bad.ts

/ good.ts

fixture — a new rule is a good first contribution.

• Fork the repo

• Create a branch: git checkout -b feat/rule-your-rule-name

• Add your rule in packages/core/src/rules/index.ts

• Add fixtures in packages/core/tests/fixtures/your-rule-name/

• Run tests: npm test

• Open a PR

Issues labeled good first issue are pre-scoped and ready to pick up.

MIT — free to use in personal and commercial projects.