CodeGuardian Live

Copy a snippet from an AI assistant or a developer Q&A site, and CodeGuardian reads it before you paste it. If it finds a hard-coded API key, a query built by string concatenation, a shell command piped straight from the internet, or a hash you should not be using for passwords, a panel names the problem, points at the line, and shows the safer pattern. It takes about twenty milliseconds, and nothing you copy ever leaves your machine. WHY IT RUNS WHERE IT DOES Most scanners run in CI, which is after the mistake is already committed. This one runs in the two seconds between copying and pasting, which is the only moment the fix is still free. It reads the structure of the page rather than guessing at it. On AI chat surfaces the "Copy code" button dispatches no copy event at all, so a copy listener alone is blind to the most common way people take code out of a chat; that path is handled explicitly. And only the code in a reply is scanned, never the prose around it, so an explanation of SQL injection is not reported as SQL injection. WHAT IT LOOKS FOR 83 rules in seven families: - Secrets and keys, including a behavioural pass that catches credentials in formats no catalog knows about - Injection, with cross-line taint tracking from the request to the sink - Weak cryptography, from broken hashes to disabled TLS verification - Malicious patterns such as encoded payloads and remote scripts piped into a shell - Server-side request forgery, including cloud metadata endpoints - Supply-chain risks hidden in install commands - Deprecated and removed APIs Thirteen programming and configuration languages are covered. PRIVACY, ENFORCED IN CODE - No network request exists anywhere in the extension. The content security policy sets connect-src 'none', so one cannot be added by accident. - No account, no telemetry, no server. - The clipboardRead permission is never requested. The scanner reads the selection inside the copy event itself, so it structurally cannot see anything you copied somewhere else. - History stores rule names and line numbers. Never the code you copied. - Scanning is blocked outright on banking, authentication, government, healthcare and password-manager sites, with no setting that can switch the block off. MEASURED, NOT CLAIMED The test suites ship inside the extension folder: 128 engine assertions, full recall on the benchmark corpus, 0.8 ms p95 scan latency, and no crashes across 3,000 fuzz cases. Run them yourself with node tests/run-tests.mjs ALSO INCLUDED - A searchable local history in the side panel, exportable as JSON - A scanner for files you have just downloaded, read inside the tab and never uploaded - Ctrl+Shift+Y, or a right-click, to scan any selection on demand - Pause on a single site without disabling the extension - Light and dark, following your browser It runs on the major developer Q&A, code-hosting, documentation and package sites, and on the main AI assistants. The complete list is declared in the extension manifest and published on the project page.