llm-sast-scanner：面向 AI 编程的 34 类漏洞扫描工具

🛡️ llm-sast-scanner - Clear vulnerability checks for AI coding

🚀 Getting Started

llm-sast-scanner helps AI coding agents find security issues in code with structured checks. It focuses on 34 vulnerability classes and gives clear results that are easier to review.

Use the release page to get the Windows version and run it on your PC.

💾 Download for Windows

Open the release page
Find the latest release at the top of the page
In the Assets section, download the Windows file
Save the file to your computer
Open the file to start the app

If Windows asks for permission, choose the option to run it.

🖥️ Before You Start

Use a Windows 10 or Windows 11 PC with:

At least 4 GB of RAM
About 200 MB of free disk space
A stable internet connection for the first download
Permission to open downloaded files

For best results, close other large apps before you start.

📦 What This Tool Does

This app helps with code security checks. It gives AI agents a structured way to spot common risks such as:

SQL injection
Command injection
Cross-site scripting
Path traversal
Weak authentication checks
Hardcoded secrets
Unsafe file handling
Broken access control
Data exposure
Unsafe deserialization
SSRF
Insecure defaults

It checks code against 34 vulnerability classes, so the output stays organized and easy to review.

🧭 How to Run It

Download the Windows release from the release page
Open your Downloads folder
Double-click the file you downloaded
If a prompt appears, click Run or Yes
Wait for the app to open

If the file is a ZIP archive, right-click it and choose Extract All first. Then open the extracted app file.

⚙️ Basic Use

After the app opens, you can use it to inspect code with security rules in a clear format.

Common steps:

Point the tool at a project folder
Start a scan
Review the results
Fix the issues it flags
Scan again after changes

The results are meant to help you and your AI coding agent work through issues one by one.

🔍 What You Can Check

You can use llm-sast-scanner to review:

Web apps
API services
Python projects
JavaScript projects
TypeScript projects
Backend code
Small utility apps
Mixed codebases

It is useful when you want a fast security pass before shipping code.

🧰 File Types You May See

Depending on the release, the download may include one of these:

.exe file
.zip file
Windows installer package

If you see an .exe, double-click it to run the app.
If you see a .zip, extract it first, then open the app inside.

🔐 Security Checks Included

The scanner covers common issue areas such as:

Input validation
Output encoding
Authentication flow
Session handling
Access control
Secret storage
Unsafe system calls
File and path checks
Network request risks
Data handling errors
Logic flaws
Unsafe parsing

These checks help catch issues before they reach production.

🧪 Example Use Case

If you are asking an AI agent to write code, you can run llm-sast-scanner after the code is generated. It can help you find risky patterns like:

User input sent to a database without checks
User data shown on a page without encoding
A shell command built from raw input
A file path built from unchecked values
Credentials stored in plain text

This makes review faster and more consistent.

🛠️ If the App Will Not Open

Try these steps:

Right-click the file
Choose Run as administrator
Check if Windows blocked the file
Move the file to a simple folder like Downloads or Desktop
Download the release again if the file seems damaged

If you used a ZIP file, make sure you extracted all files before opening the app.

📁 Suggested Folder Setup

Keep the app in a simple place like:

Downloads
Desktop
C:\Tools\llm-sast-scanner

Avoid deep folder paths with many nested folders. Short paths are easier to manage on Windows.

🧑‍💻 For AI Coding Workflows

This tool fits well into a coding flow where an AI agent writes code and then checks it for security risks.

A simple flow looks like this:

Generate code with an AI agent
Run llm-sast-scanner on the project
Read the flagged issues
Ask the AI agent to fix them
Run the scan again

This gives you a repeatable review step without needing deep security knowledge.

📌 Common Questions

Does it work on Windows?
Yes. Use the release page to download the Windows file.

Do I need to know programming?
No. You only need to download the file, open it, and follow the on-screen steps.

Can I use it on any project?
It is meant for code projects where you want a security review.

What makes it useful?
It gives structured checks across many common vulnerability classes, so results are easier to follow.

🔗 Download

Visit the release page to download and run the Windows file