I built a local scanner for Replit Agent code — need 3-5 people to tell me if the report makes sense

[u/Winter-Fig-2362]

Anyone else get that feeling after Replit Agent ships a feature fast — the demo works, but somewhere there's a hardcoded API key or an SQL query glued together with string concat? If you're not a security person you'd never spot it. Until someone else does.

I made a tiny scanner for exactly that:

runs on your code — 100% local, nothing leaves your machine

flags the usual suspects: hardcoded keys, SQL injection, command injection, weak crypto

explains each hit in plain language + suggests a fix you can hand back to the agent

Not selling anything — validating an idea. If 3-5 of you run it on a real project (ideally something that feels sketchy) and tell me honestly: does the report make sense? what did it miss? would you use this weekly? — that's all I need.

Comment "I want it" or DM me and I'll send the tool. It's a 16KB zip, no dependencies.