SAST, SCA and secrets scanning for AI-generated code

What does each scan look for?

Static application security testing (SAST) analyzes source code without running it and flags patterns that lead to vulnerabilities, such as user input that reaches a database query without being escaped. AI SAST uses a model, alone or with rules, to find issues and to reduce false positives.

Software composition analysis (SCA) lists the open source packages a project depends on and matches them against known vulnerabilities and licenses. It matters more when an agent adds dependencies, because each new package brings its own dependency tree.

Secrets scanning looks for credentials such as API keys and tokens in code and Git history. A key that reaches a shared branch has to be treated as exposed and rotated, so the earlier it is caught, the less work it causes.

Why do these checks still matter when an agent has guardrails?

Guardrails act while the agent works: they shape the prompt, filter what leaves the machine and block risky commands. They do not see every change. Code also arrives from developers who type it, from other assistants and from automated fix agents. The pull request is the one point every change passes through, so it is where a team can require a clean result before merge.

This is why our scoring keeps the two layers apart. Coding agent guardrails carry 30% of the score, and AI-generated code coverage, which measures these scans, carries 20%.

Where do the scans run?

• In the IDE. Findings appear while the code is written. Legit VibeGuard runs SAST and SCA in the IDE as code is generated, and Aikido Security's free IDE plugin scans JavaScript, TypeScript and Python for SAST issues and secrets in VS Code, Cursor and Windsurf.

  Source: Legit Security: VibeGuard · Reviewed Sep 2026

  Source: Aikido Security: IDE integrations · Reviewed Sep 2026

• At commit and push. Pre-commit checks and push protection stop a change before it leaves the machine or reaches the server. GitHub push protection blocks pushes that contain secrets, and Endor Labs detects secrets before commit.

  Source: GitHub Docs: about GitHub Advanced Security · Reviewed Sep 2026

  Source: Endor Labs · Reviewed Sep 2026

• At the pull request. Scans run in CI or in the source control platform and report on the change. GitHub code scanning with CodeQL and Copilot Autofix work on pull requests, and Semgrep puts remediation guidance in pull requests and IDEs.

  Source: GitHub Docs: about GitHub Advanced Security · Reviewed Sep 2026

  Source: Semgrep · Reviewed Sep 2026

• Across existing scanners. ASPM platforms pull findings from several scanners into one queue. Legit Security orchestrates existing scanners and de-duplicates their findings.

  Source: Legit Security: ASPM platform · Reviewed Sep 2026

What should a first rollout include?

• Turn on secrets scanning with push protection first, because a leaked key costs the most to undo.
• Run SCA on every pull request that changes a manifest or lockfile, including changes an agent makes.
• Add SAST to pull requests on the repositories where agents write the most code, then widen the scope.
• Decide which findings block a merge and which only comment, and write the rule down.
• Review the false-positive rate after a few weeks; AI SAST and auto-triage features exist to reduce it.

How do the tools we score compare on these checks?

On AI-generated code coverage, Legit Security leads at 5.0 out of 5, and OX Security, Aikido Security and GitHub Advanced Security score 4.0. Every tool we score runs these checks in some form; the differences are in where they run and whether findings from other scanners are pulled in.

The full comparison shows every tool's score and reason.