Secure AI-generated code
Secure everything your agents ship
Find the vulnerabilities your agents introduce. Fix them before they ship.
Fencer reviews your code, proposes fixes, and helps your team keep security in step with development.
Honey-Corp/honeybucket
The repository contains multiple committed secrets (private keys, API tokens, database credentials, OAuth client secrets) and hardcoded credentials in source code. A TLS private key and .env files with real tokens are tracked in git. The Django settings file hardcodes a GitHub PAT, Django SECRET_KEY, and database password directly in source. A stored XSS vector exists via the Django markdown-to-HTML rendering pipeline using |safe.
Fix VULN-B2M: Discovered a private key
fencer-code[bot]opened 2 minutes agoBot
fencer-code
SQL injection in get_user via f-string interpolation
User input is interpolated straight into a raw SQL query. An attacker can dump auth_user, including password hashes.
Suggested change
Some checks haven't completed yet
- FencerIn progress — Code security scan
No conflicts with base branch
All checks have passed
- FencerSuccessful in 1m — Fencer Scan Results
No conflicts with base branch
More code shouldn't mean more security work
AI agents are generating and shipping code faster than engineers can manually review it. Skip the review, and vulnerabilities can slip through. Review every change yourself, and security becomes a bottleneck.
Fencer puts security into the development workflow, so your team can keep shipping without choosing between speed and security.
How It Works
Code security that keeps up with your agents
Find and fix security issues as your agents write and ship code, without adding manual review to every change.
Add user search endpoint #101
Some checks haven't completed yet
2 in progress checks
- FencerIn progress — Code security scan
- Fencer / AI Security ReviewIn progress — AI security review
No conflicts with base branch
Some checks were not successful
2 failing checks
- FencerFailing after 1m — 2 findings
- Fencer / AI Security ReviewFailing after 2m — 1 finding needs a change
No conflicts with base branch
Some checks haven't completed yet
2 queued checks
- FencerQueued
- Fencer / AI Security ReviewQueued
No conflicts with base branch
All checks have passed
2 successful checks
- FencerSuccessful in 1m — no findings
- Fencer / AI Security ReviewSuccessful in 2m — no findings
No conflicts with base branch
fencer-code13m ago
AWS credentials committed to the repository
An access key pair is checked into settings.py. Anyone with read access to this repository has it.
Recommendation: Read them from the environment and rotate the exposed pair.
Suggested change
fencer-code13m ago
SQL injection in get_user via f-string interpolation
User input is interpolated straight into a raw SQL query. An attacker can dump auth_user, including password hashes.
Recommendation: Use a parameterized query.
Suggested change
- Apply suggestion from fencer-codedjangov2/honeybucket/settings.pyVerifieda3f91c2
- Apply suggestion from fencer-codedjangov2/honeybucket/api/views.pyVerified7b2e044
Ask Fencer
Get started with some examples
Summarize security changes
Summarize the security-relevant changes to our system over the last week.
Review open criticals
Which critical vulnerabilities are open right now, and which need discussion?
Prepare review agenda
Prepare an agenda of vulnerabilities to review at the monthly security meeting.
The repository contains multiple committed secrets (private keys, API tokens, database credentials, OAuth client secrets) and hardcoded credentials in source code. A TLS private key and .env files with real tokens are tracked in git. The Django settings file hardcodes a GitHub PAT, Django SECRET_KEY, and database password directly in source. A stored XSS vector exists via the Django markdown-to-HTML rendering pipeline using |safe.
Honey-Corp/honeybucket
The repository contains multiple committed secrets (private keys, API tokens, database credentials, OAuth client secrets) and hardcoded credentials in source code. A TLS private key and .env files with real tokens are tracked in git. The Django settings file hardcodes a GitHub PAT, Django SECRET_KEY, and database password directly in source. A stored XSS vector exists via the Django markdown-to-HTML rendering pipeline using |safe.
Scan every PREvery pull request is checked for vulnerabilities, secrets, and risky dependencies before merge.
Fix vulnerabilitiesAsk Fencer to fix vulnerabilities, and it opens pull requests with the proposed upgrades.
Run a full code reviewReview your repository on demand to find issues beyond individual pull requests.
Prioritize findingsSee security findings across your codebase, prioritized so your team knows what to tackle first.
Spend less time chasing false positives
Fencer evaluates findings in the context of your codebase to filter out noise and surface the vulnerabilities that need attention, with the context to help your team act.
Curious about what's already in your code? Your first 14 days of code scanning are free.
Get StartedYour agents change more than code
AI agents can modify infrastructure-as-code and cloud configuration, creating risks beyond the application itself. Fencer checks infrastructure changes in pull requests and monitors your live cloud environment for risky configurations.
A field of 12 findings, 1 of which need attention.
Validate your security after a big change
Run a full pen test in hours, get working proof for high and critical findings, then fix and retest to confirm the issues are resolved.
A session token lifted from the SQL injection authenticates a webhook write. The webhook URL points at the instance metadata address, and the delivery log records the temporary IAM credentials it returned.
Cloud role credentials obtained from an application-layer flaw, reaching storage outside the application's own boundary.
Teams shipping code with more confidence
We don't have time to constantly stop and run separate security processes. Security is just part of our workflow, which makes a big difference for a lean engineering team.
Prithvi Narasimhan
CTO
Every PR that is opened by an engineer will have a Fencer review on it, and that review will call out security holes so those vulnerabilities never make it into our code.
Ari Baranian
CEO & Co-founder
My team feels like our time is finally being used well in this category of work. Fencer is focused on surfacing the findings that matter, unlike other tools which were spewing off a bunch of garbage that we needed to keep up with.
Ben Papillon
CTO & Co-founder