What's under the hood, because "AI security scanner" do deserves the suspicion. We use opensource security tools (the security engine), 29 security rules that I wrote for the most patterns that show up specifically in AI-generated code : RLS, Secrets, Buckets, Auth, Mass-assignment, Webhooks, CORS, Debug, Randomness, Ownership and Vulnerable dependencies Our AI layer does two jobs and neither is finding bugs. It reviews CRITICAL and HIGH findings for false positives and it writes the fix. Everything that detects anything is deterministic.