AI writes your code. Who checks it?

Ask for a profile-update endpoint and you get a good one — validated input, parameterized query, ownership checked. The model knows all that. What it skips is the part nobody asked for: the field allowlist. The handler spreads the request body straight into the record, so send "role": "admin" next to your new username — and the server writes it. No error, no log, admin.

Airtight is the part of the request nobody makes: hard gates on what the assistant may emit, checked before the code reaches you.

flowchart LR
  A[You ask for a feature] --> B[Model writes it]
  B --> C{Airtight<br/>67 gates}
  C -->|fails| D[Rewrite]
  D --> C
  C -->|passes| E[Code that<br/>already passed]

Measured, not claimed

One login brief, two agents — one with Airtight, one without. A blind third scored and ran both.

26 applicable gates → 25/26 with Airtight, 16/26 without.

Both builds got the fundamentals right — password hashing, parameterized SQL, httpOnly cookies, session regeneration. The model is not incompetent. The control's ten failures are the part nobody asks for: a timing oracle on login, a hardcoded session-secret fallback, stack traces in error responses, no schema validation, a swallowed exception, no security log, no rate limit, no lockout. Omissions and defaults, not broken crypto.

The one gate the Airtight build failed is in the scorecard too — Gate 101, a swallowed catch in its own password helper. Measured means measured, including our own miss.

Every verdict was adversarially re-derived by a second auditor told to refute it; none was overturned. The remaining 41 gates never apply to a login app — injection, XSS, SSRF and supply-chain checks had nothing to bite here. Per-gate protocol with file:line evidence → validation/scorecard.md.

Both apps and the full comparison → validation/.

Install

npx skills add Zyoffsec/airtight-secure-coding

Or clone it into your skills folder (Claude Code, Cursor, Codex):

git clone https://github.com/Zyoffsec/airtight-secure-coding ~/.claude/skills/airtight

Then forget it. Airtight runs itself — write code as usual and the gates apply silently. No command to invoke.

Usage

Command What it does
(default) You write code; gates apply silently.
airtight audit <target> Scores code against the gates. Read-only.
airtight harden <target> Finds and fixes gate failures.
airtight prove <target> Probes your local code with edge-case input.

What it catches

67 gates across 13 topics, mapped to OWASP Top 10 (2021) + CWE. Each is binary and numbered — every finding cites its gate. Full list → references/gates.md.

What it doesn't: business-logic bugs, unknown CVEs in your dependencies, or architecture review — those need a human. Airtight is the first check, on the mistakes mechanical enough to check mechanically. It never calls code "secure" — only which gates held.

Demo

A short recording is coming — one innocent request with one extra JSON field, an account that quietly becomes admin, then the same request against the Airtight build bouncing off Gate 13. It is the point of the whole project. Contributions welcome.

MIT License · Contributing