Skip to content
OPQAI.
Sourced beginner / 💻 Coding

Find AI Code Security Bugs with hallint

Job to be done: Identify and fix security vulnerabilities in AI-generated code

🇳🇬 Ways to use this in Nigeria

Ideas to get you started, adapt to your situation.

  • Student

    Scan the Python script for your final year project, generated with ChatGPT, to ensure it doesn't have common security vulnerabilities before submission.

  • Entrepreneur

    Before launching your MVP, use hallint to check the AI-generated backend code for your new fintech app for potential security loopholes like SQL injection or hardcoded API keys.

  • 9-5 employee

    As a software developer, use hallint to scan the AI-generated code for a new internal tool, catching security flaws before it's reviewed by your team.

What you’ll get

You will learn how to use hallint, a free tool, to scan code written by AI assistants for common security mistakes. This helps you catch bugs that regular code checkers miss, making your AI-assisted code safer to use. It works by looking for specific patterns that AI assistants often get wrong, like hardcoded passwords or ways to inject malicious code.

Tools you need

  • hallint (free): A command-line tool that checks AI-generated code for security flaws.
  • Node.js (free): A runtime environment that allows you to run JavaScript code on your computer. You’ll need this to install and run hallint.
  • AI Assistant (Copilot: paid, Claude: freemium, ChatGPT: freemium): Any AI tool you use to write code, like GitHub Copilot, Claude, or ChatGPT.

Steps

  1. Install Node.js: If you don’t have Node.js installed, download and install it from the official website. This is necessary to run hallint. You should see a confirmation message after installation, or you can check by opening your terminal or command prompt and typing node -v. You should see a version number.

  2. Run hallint on your code: Open your terminal or command prompt. Navigate to the folder where your code is saved. Then, run the hallint command followed by the path to your code. The author suggests ./src as a common starting point.

    npx @asyncinnovator/hallint-cli ./src

    If you want to scan specific files, you can use patterns like this:

    npx @asyncinnovator/hallint-cli "./src/**/*.ts"

    You should see hallint start scanning your files. If it finds any security issues, it will list them. If it finds no issues, it will simply finish without errors.

  3. Filter for serious issues (optional): If you only want to see the most critical problems, you can add a flag to the command:

    npx @asyncinnovator/hallint-cli ./src --min-severity high

    This will only show findings marked as ‘high’ severity or more.

Original source

This workflow is based on a blog post by asyncinnovator titled “I Built a Linter That Catches the Security Bugs AI Assistants Keep Writing”, shared on the DEV Community platform. The author explains the common security pitfalls found in AI-generated code and introduces hallint as a solution.

Notes & variations

  • Free tier alternative: hallint itself is free and open-source. For AI code generation, you can use the free tiers of Claude or ChatGPT, though they might have usage limits.
  • Common mistake: Forgetting to install Node.js first. npx is a tool that comes with Node.js, so if you get an error like “command not found: npx”, you need to install Node.js.
  • Tip for better results: Integrate hallint into your code review process or a continuous integration (CI) pipeline. The tool is designed to exit with an error code if it finds critical issues, which can automatically stop your code from being merged if it’s not secure.

Keep going

More Coding workflows