Security Analysis

Bilt provides deterministic, application-level security analysis specifically engineered for software built with AI coding assistants (Claude Code, Cursor, Windsurf, Devin, Codex, Antigravity) and human development teams.

1. Security Philosophy & Authority

Bilt's analysis model is governed by two uncompromising principles:

• Deterministic Analysis as the Security Authority: AI never decides whether code passes, fails, or meets production gates. All security evaluations are driven by mathematical AST traversal (Babel parser), Shannon entropy algorithms (H > 4.5 bits/char), cryptographic provider specifications, and taint-style data-flow tracing from route inputs to database sinks. Optional AI assistance (via bilt explain or downstream agent loops) only generates natural language explanations or suggested patches—it has zero authority over the gate status.
• Honest Scope Without Vanity Metrics: Bilt does not claim complete OWASP compliance, nor does it generate arbitrary security scores (e.g. “98% secure”) or vague marketing claims like “enterprise-grade security.” Where a security property can be proven deterministically, Bilt enforces it with an automated pass or fail. Where an issue depends on multi-tenant business intent or external cloud configuration, Bilt flags it as needs-review with concrete evidence and verification procedures.

2. Superficial Scanners vs. Bilt

Traditional linters and superficial scanners rely on simple keyword matches that trigger excessive false alarms on legitimate code while missing real structural flaws. Bilt traces execution context, data flow, and authorization boundaries.

3. Implemented Security Checks & Rule Matrix

Bilt implements concrete static rules and guided verification routines covering critical application security domains, mapped to corresponding OWASP Top 10 and CWE categories:

Hardcoded Secrets & Credentials

What Bilt looks for: Hardcoded API tokens, private keys, cloud credentials, and connection strings across 31+ cryptographic providers (AWS, Stripe, OpenAI, GitHub, Supabase, Anthropic, Slack, Twilio, SendGrid, database URIs).
Evidence analyzed: Pattern matching on provider key prefixes (e.g. AKIA, sk_live_), Shannon entropy (H > 4.5), and scanner checks on committed .env files.
Why it matters: Leaked credentials grant immediate administrative access to databases, third-party APIs, and cloud infrastructure.
Mode & Remediation: Fully Automated. bilt fix --safe moves secrets to .env, updates source references to process.env, updates .gitignore, and generates .env.example placeholders.

Environment & Configuration Security

What Bilt looks for: Server secrets prepended with client public prefixes (NEXT_PUBLIC_, VITE_, REACT_APP_ containing keywords like SECRET, SERVICE_ROLE, or DATABASE_URL); duplicate env entries; missing .env.example; and unmapped env references.
Evidence analyzed: AST property evaluation of process.env cross-referenced against all .env* files in the workspace.
Why it matters: Client public prefixes cause build bundlers to inline backend secrets into client JavaScript bundles accessible to any browser visitor.
Mode & Remediation: Fully Automated. Removes public prefixes from backend secrets and synchronizes missing keys into .env.example.

Authentication Weaknesses

What Bilt looks for: jwt.decode() without cryptographic verify, plaintext password comparison (password === user.password), weak hashes (MD5, SHA1), auth bypass stubs (return true in auth filters), hardcoded admin credentials, and JWTs issued without expiry.
Evidence analyzed: AST call expressions, binary expression operators, and route handler middleware chains.
Why it matters: Unverified tokens allow attackers to forge arbitrary claims. Plaintext password comparisons lead to total credential compromise upon database exposure.
Mode & Remediation: Automated checks for structural flaws; Guided review for overall authentication flow. Automatically upgrades jwt.decode() to jwt.verify() when signing secret references are present.

Authorization & Privilege Escalation

What Bilt looks for: Privileges, user roles, or administrator flags read directly from client-controlled request inputs (req.body.isAdmin, req.body.role, req.query.role, or localStorage) without server session validation.
Evidence analyzed: AST member expressions on request parameters inside API mutation handlers.
Why it matters: Attackers forge HTTP payloads to elevate themselves to administrator privileges without administrative rights.
Mode & Remediation: Automated detection with hard FAIL (AUTHZ-AUTO-002). Guided code update: derive user roles exclusively from verified server sessions or signed JWT claims.

Broken Object-Level Authorization (IDOR / BOLA)

What Bilt looks for: Endpoints with dynamic route parameters (/api/orders/:id, /documents/[id]) querying database records without checking resource ownership against the authenticated user.
Evidence analyzed: RouteMap dynamic path parameters cross-referenced with database lookup parameters (findById, findUnique, where: { id }) lacking userId: session.user.id filters.
Why it matters: Any authenticated user can modify the ID parameter in the URL to view, modify, or delete another user's records.
Mode & Remediation: Guided (needs-review). Non-negotiable architectural invariant: IDOR emits needs-review rather than fail because ownership models frequently involve multi-table tenant checks. Bilt provides query scoping guidance.

Mass Assignment Vulnerabilities

What Bilt looks for: Request bodies passed directly into persistence operations (prisma.user.update({ data: req.body }), Model.create(req.body)) where the target model contains sensitive columns (role, isAdmin, balance, tenant_id).
Evidence analyzed: Data-flow paths connecting req.body to ORM mutations without schema allowlisting or field destructuring.
Why it matters: Callers can inject extra fields into request payloads to overwrite protected database properties.
Mode & Remediation: Automated (High severity). Guided code remediation: explicitly destructure permitted fields (const { name, bio } = req.body) or validate through a strict Zod schema.

Input Validation & Injection (SQLi, Command, XSS)

What Bilt looks for:

• SQL Injection (CHECK-INPUT-001): Template literal interpolation or string concatenation in queries (query(`SELECT * FROM users WHERE id = ${id}`), $queryRawUnsafe).
• Command Injection (CHECK-INPUT-002): Dynamic arguments in exec(), spawn(), or child_process.
• Path Traversal (CHECK-INPUT-003): User parameters passed directly to filesystem read/write routines.
• Unsafe HTML Rendering (CHECK-INPUT-004): Raw dangerouslySetInnerHTML without DOMPurify sanitization.
• Missing Schema Validation (CHECK-INPUT-005): Mutating POST/PUT/PATCH endpoints without schema libraries (zod, joi, yup).

Mode & Remediation: Automated. SEC-INP-004 safely wraps HTML in DOMPurify. Injection findings escalate with exact line numbers and parameterized query guidance.

API Method Restrictions & Catch-Alls

What Bilt looks for: Catch-all or wildcard HTTP method handlers (app.all(), router.all(), Next.js export async function ALL()).
Evidence analyzed: AST route declaration scanning across all API files.
Why it matters: Catch-all matchers accept unexpected HTTP methods (TRACE, HEAD, SEARCH) that can bypass method-specific middleware and trigger unintended code execution.
Mode & Remediation: Automated. bilt fix safely restricts wildcard handlers to explicit HTTP verbs (GET, POST).

Unsafe API Exposure & Documentation

What Bilt looks for: Interactive API documentation endpoints (Swagger UI, GraphQL Playground, OpenAPI schema specs) mounted in production builds without environment guards.
Evidence analyzed: Dependency and middleware inspection for packages like swagger-ui-express, apollo-server, and graphql-playground.
Why it matters: Publicly exposed Swagger/Playground endpoints assist external attackers with automated endpoint enumeration and schema reconnaissance.
Mode & Remediation: Automated. bilt fix wraps doc routes in if (process.env.NODE_ENV !== 'production') conditions.

Sensitive Response Data Exposure

What Bilt looks for: API handlers serializing database entities directly into HTTP responses where attributes contain sensitive fields (passwordHash, secretKey, apiToken, ssn).
Evidence analyzed: AST property inspection of response objects and OpenAPI response schemas.
Why it matters: Leaking password hashes or internal secret keys compromises user credentials and violates privacy regulations even when network transit is encrypted.
Mode & Remediation: Automated (Critical severity). Guided remediation: use explicit response DTOs or Prisma select / omit clauses.

Database Security & Client Driver Leakage

What Bilt looks for: Direct backend database driver imports (@prisma/client, pg, mysql2, mongoose, drizzle-orm) inside client components; database connection strings lacking TLS/SSL enforcement (sslmode=require); multi-step mutations without database transactions.
Evidence analyzed: File-path import boundaries, database connection URL query strings, and state mutation AST patterns.
Why it matters: Bundling database drivers into client-side code exposes database schemas and connection credentials to browsers. Unencrypted connections risk network interception. Non-transactional mutations allow race-condition tampering.
Mode & Remediation: Automated for driver imports and SSL strings; Guided for backup/PITR procedures.

Unsafe File Uploads

What Bilt looks for: File upload handlers (multer, formidable, uploadthing, S3 clients) lacking file size caps, MIME allowlist verification, or path traversal safeguards.
Evidence analyzed: Multipart file upload libraries and filesystem storage paths.
Why it matters: Unrestricted uploads allow remote code execution via executable scripts (.php, .exe, .html), storage exhaustion (DoS), or server file overwrites.
Mode & Remediation: Guided (needs-review). Enforce strict MIME allowlists, a 5MB size ceiling, and isolated cloud object storage.

Dependency Integrity & Lockfiles

What Bilt looks for: Repositories missing package lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock); Dockerfiles copying .env files or running as root; Terraform configurations without .gitignore for .tfvars.
Evidence analyzed: File existence, package manifests, Dockerfile instructions, and Infrastructure-as-Code files.
Why it matters: Deploying without lockfiles results in non-deterministic builds where compromised upstream packages can enter production without detection.
Mode & Remediation: Automated. Auto-generates .dockerignore, removes COPY .env from Dockerfiles, and adds .gitignore entries.

Insecure Transport & Security Headers

What Bilt looks for: Wildcard CORS origin (* or true) configured with credentials: true; disabled TLS verification (rejectUnauthorized: false); cookies missing httpOnly, secure, or sameSite; Express/Fastify apps running without helmet.
Evidence analyzed: CORS options, HTTPS agent settings, res.cookie() options, and middleware stacks.
Why it matters: Wildcard CORS with credentials allows third-party sites to steal authenticated user data. Insecure cookies allow XSS credential theft. Missing TLS verification permits man-in-the-middle attacks.
Mode & Remediation: Automated. SEC-STO-002 adds secure cookie flags. SEC-NET-001 removes rejectUnauthorized: false. SEC-CFG-002 mounts Helmet.

Deployment & Container Misconfiguration

What Bilt looks for: Browser source maps enabled for production builds (productionBrowserSourceMaps: true in next.config.js); production Docker containers running with ENV NODE_ENV=development.
Evidence analyzed: Framework configuration exports and Dockerfile environment instructions.
Why it matters: Production source maps reveal unminified original source code, internal logic, and comments to anyone in browser DevTools. Development mode disables performance optimizations and exposes verbose debug traces.
Mode & Remediation: Automated. bilt fix --safe toggles productionBrowserSourceMaps to false and sets NODE_ENV=production.

Error Stacks & Credential Log Leaks

What Bilt looks for: Raw stack traces returned in HTTP responses (res.json(err.stack), NextResponse.json({ error: err.stack })); sensitive credentials, tokens, or passwords printed to stdout via console.log().
Evidence analyzed: AST matching of response serialization arguments and console call expressions.
Why it matters: Stack traces leak internal filesystem paths, dependencies, and database schemas. Plaintext credential logging stores secrets in central log aggregators.
Mode & Remediation: Automated. SEC-CFG-001 sanitizes API error response structures.

Privacy & PII Handling

What Bilt looks for: Government identifiers (SSN, national ID, passport), birthdates, or driver's licenses stored in schema models without field-level encryption, access auditing, or account deletion flows.
Evidence analyzed: Schema and data model attribute inspection for PII naming tokens.
Why it matters: PII exposure violates GDPR/CCPA regulations and risks identity theft.
Mode & Remediation: Guided (needs-review, evidence required).

Payments & Webhook Signatures

What Bilt looks for: Payment webhook handlers (Stripe, PayPal, Razorpay) lacking cryptographic signature verification (stripe.webhooks.constructEvent); backend handling of raw credit card fields (cardNumber, cvv, cardExp).
Evidence analyzed: Webhook handler routes, signature verification calls, and card attribute identifiers.
Why it matters: Unverified webhooks allow attackers to simulate checkout completions and claim goods without paying. Handling raw card numbers violates PCI-DSS.
Mode & Remediation: Guided for webhook verification; Automated for raw credit card fields (fail).

Abuse, Cloud Cost & Resource Exhaustion

What Bilt looks for: Paid AI or external APIs (OpenAI, Anthropic, Replicate, ElevenLabs, Twilio, SendGrid) invoked from API routes without authentication or rate limiting (@upstash/ratelimit, express-rate-limit); absence of global rate limiting on public API suites.
Evidence analyzed: Cross-referencing third-party SDK calls against route authentication middleware and rate limiter decorators.
Why it matters: Un-throttled paid endpoints allow attackers to flood APIs, exhausting account balances within minutes and generating huge cloud bills (Denial of Wallet).
Mode & Remediation: Guided (needs-review, mandatory category).

AI Integrations & LLM Output Execution

What Bilt looks for: Dynamic execution of untrusted AI model outputs (eval(completion), exec(), new Function()); unrestricted AI agent tool execution; system prompt concatenation with untrusted user input without structural boundary separation or secrets embedded in prompts.
Evidence analyzed: AST tracing of LLM completion variables into dynamic execution sinks.
Why it matters: Prompt injection attacks can manipulate the LLM into generating malicious code that the server executes, granting attackers remote code execution (RCE).
Mode & Remediation: Automated (Critical severity). Guided refactoring: parse model outputs as structured JSON validated against strict Zod schemas.

4. Bilt's Internal Security Engineering

Because Bilt evaluates untrusted code generated by autonomous AI agents, the security engine itself implements defense-in-depth protections:

5. Safe Remediation & Escalation

When an automated fix is safe, Bilt repairs it without guessing. When automated remediation cannot safely make progress, Bilt breaks the cycle and escalates:

• Atomic Snapshots & Instant Rollback: Every bilt fix run records a complete file snapshot in .bilt/snapshots/ before writing changes. Running bilt undo instantly rolls back the entire transaction in sub-2ms.
• Loop Termination Guarantee (Exit Code 4): Tracked iteration state in .bilt/loop-state.json halts execution with status: "escalate" (exit code 4) if an AI agent repeats identical findings across 3 consecutive iterations, enters oscillation thrashing ($A \rightarrow B \rightarrow A \rightarrow B$), or exceeds its maximum iteration budget (default: 15).

# 1. Evaluate your repository against the complete security taxonomy
npx bilt check

# 2. Run static security and secret analysis
npx bilt scan

# 3. Inspect API routes for mass assignment, method allowlists, and schema leaks
npx bilt api-scan

# 4. Strict PR diff verification with anti-tamper and loop protection in CI
npx bilt verify --base origin/main --format agent

# 5. Apply safe automated security remediations
npx bilt fix --safe

# 6. Instant atomic rollback if needed
npx bilt undo