vitorlourenco

We got owned by Snyk on our own product. Last week Snyk flagged a real transitive vulnerability in our production repo ([email protected] via resend). We were only reading package.json - like most lightweight scanners still do — while the actual attack surface lives in package-lock.json.

So we did what we always do: we fixed it.

Shipping fast is not the hard part anymore. Understanding what is safe to change is.

In our latest CodeSlick / Endure post, we break fragility down into two forces: . Intent drift inside files . Hidden coupling between them

When both grow quietly, refactors become incidents. If you lead a team working on a living, evolving codebase, this model may feel familiar.

We built Endure because we were tired of discovering which parts of our system were dangerous only after production told us.

It analyzes your repository and surfaces which files are likely to break together — before you merge.

When we ran it on our CodeSlick codebase, it flagged the exact module behind our worst production incident.

It’s a working MVP in research preview, running on real repositories.

We’re actively looking for teams willing to validate this.

Production is live.

Critical fixes ship next week.

The author left.

Congratulations. It’s yours now. Documentation? “Should be somewhere.”

One hour in: You find scattered notes. No context. No history. Just comments like // handles edge cases.

Twenty-four hours in: Tests pass. You understand less than when you started. Every change feels like cutting the wrong wire.

This is normal. It’s called code archaeology.

And it’s expensive. Knight Capital Group lost $440M in 45 minutes. CrowdStrike pushed a config no one fully understood. The xz Utils backdoor incubated for two years.

Not reckless teams. Just systems with no memory.

We broke down the six recurring pains of a codebase that forgot its own why.

Read: codeslick.dev/blog/six-pains-codebase-without-memory

Speed is easy to measure. Resilience is not.

We’ve spent the last years optimizing for velocity, automation, AI-assisted output. The result? More code. Faster cycles. Shorter feedback loops.

But very few teams are asking a harder question: Is the system getting stronger — or just more fragile at scale?

That’s why I’m excited about what we’re building with Endure, a research-driven attempt to analyze structural resilience in modern, AI-accelerated systems: • Antifragility instead of surface metrics • Context treated as a dependency • Hidden coupling detection • Structural risk beyond code smells

If you’re shipping with AI in the loop, this matters. AI compounds decisions across sprints. Small structural weaknesses don’t stay small.

This is a limited research preview, and we’re being selective.

If you care about long-term system integrity — not just short-term throughput — take a look at the original announcement and see if this resonates.

Exciting News!

CodeSlick Security Scanner is now LIVE on the GitHub Marketplace!

As your ultimate code guardian, it automatically reviews every pull request to catch vulnerabilities, AI-generated code risks (like hallucinations from Copilot or ChatGPT), and ensures OWASP 2025 compliance – all right inside GitHub.

Why CodeSlick? Here are the game-changing benefits: AI-Powered Detection & Fixes: Spots issues in JS, TS, Python, Java, Go, and more – including XSS, SQL injections, secrets, and dependency vulns. Plus, one-click auto-fixes to heal your code instantly!

Real-Time PR Protection: Get instant verifications in comments and the Security tab, so you merge with confidence and zero drama.

Enterprise-Grade Tools for Free: SARIF uploads, SBOM generation, team dashboards, and shift-left security – perfect for devs, teams, and cloud-native pros using Kubernetes, Docker, or Terraform.

And the best part? It's completely FREE for individuals! No strings attached – just secure, slick coding.

We’ve expanded the Learn section on CodeSlick.dev to explain security and code quality from a junior-friendly, real-world perspective — not theory, not enterprise jargon. It’s about understanding: • why bugs and vulnerabilities actually happen • how small decisions in code create long-term problems • how to build good habits early, even when moving fast If you’re a vibecoder, junior dev, or early in your journey, this can save you months of pain later. https://codeslick.dev/learn

Hey HN! Solo developer here. I spent 4 months building CodeSlick - a security scanner for GitHub PRs.

What's different about v1.3 (launched today):

1. One command runs security AND tests `cs scan --verify` blocks commits only if BOTH pass Catches "security passed, prod broke" situations

2. Configurable pass/fail gates Not all-or-nothing: "block CRITICAL only" or "max 10 vulnerabilities" Teams control what blocks their PRs (not the tool)

3. Auto-creates GitHub issues for vulnerabilities Security work becomes visible (trackable like features) No more "found vulnerabilities, forgot to fix"

Technical details: - 294 security checks (SQL injection, XSS, SSRF, AI hallucinations) - 5 languages: JavaScript, TypeScript, Python, Java, Go - AST-based static analysis (Acorn for JS/TS, custom parsers for others) - Auto-detects test frameworks (npm, pytest, go test, maven, gradle) - <3s per file analysis time - OWASP 2025 compliant (95% coverage)

What I'm proud of: - First scanner to detect AI-generated code vulnerabilities - Thresholds that actually fit how teams work (not all-or-nothing) - CLI + GitHub App + WebTool (3 surfaces, same engine)

What still needs work: - No C/C++/Rust support yet - GitHub only (no GitLab/Bitbucket) - Solo founder (just me, scaling support is hard)

Try it: - CLI: npx codeslick-cli@latest init - GitHub App: https://github.com/settings/apps/codeslick-security-scanner - Blog post: https://codeslick.dev/blog/security-quality-developer-workfl...

Happy to answer questions about the technical implementation, design decisions, or trade-offs I made.

Built with: Next.js 15, TypeScript, Acorn, Neon Postgres, Vercel