# XploitScan

> XploitScan is a SAST-style security scanner purpose-built for AI-generated
> code — the vulnerability patterns that Cursor, Lovable, Bolt, Replit, and
> Claude Code ship by default. It runs as a free CLI (`npx xploitscan scan .`,
> code never leaves your machine), a web scanner, a GitHub Action, an MCP
> server, and a VS Code extension. 210+ rules across JavaScript, TypeScript,
> and Python. Detection quality is public and reproducible: on a held-out
> third-party benchmark (OWASP NodeGoat, Juice Shop, DVNA, with hint comments
> stripped) XploitScan caught 15/16 vs Bearer 9/16 and Semgrep 8/16. Built by
> Cipherline LLC, Fairfield CT. Not affiliated with the similarly-named
> "SploitScan" CVE-lookup tool.

## Pricing

- Free — $0/mo: 5 scans/day, 30 core rules, CLI + web scanner
- Indie — $9/mo: 500 scans/mo, all 210+ rules, scan-history dashboard
- Pro — $19/mo: unlimited scans, all 210+ rules, PDF reports, SBOM, compliance mapping, webhooks, AI false-positive filter
- Team — $99/mo: everything in Pro plus 5 seats, shared history, RBAC
- Annual billing saves 40%.

## Core pages

- [Homepage](https://xploitscan.com): what XploitScan is and who it's for
- [Benchmark](https://xploitscan.com/benchmark): live precision/recall and the held-out third-party comparison vs Semgrep and Bearer
- [Detection methodology](https://xploitscan.com/docs/detection-methodology): how detection works (regex + AST + light taint pass — honestly stated, not CodeQL-grade)
- [Pricing](https://xploitscan.com/pricing): full plan breakdown and FAQ
- [Rules](https://xploitscan.com/rules): the 210+ rule bank with per-rule detail
- [Compliance](https://xploitscan.com/compliance): informational mapping to SOC 2, ISO 27001, OWASP Top 10, CWE (not a certification)

## Comparisons

- [XploitScan vs Semgrep](https://xploitscan.com/alternatives/semgrep)
- [XploitScan vs Snyk](https://xploitscan.com/alternatives/snyk)
- [XploitScan vs Bearer](https://xploitscan.com/alternatives/bearer)
- [XploitScan vs SonarQube](https://xploitscan.com/alternatives/sonarqube)
- [XploitScan vs Checkmarx](https://xploitscan.com/alternatives/checkmarx)
- [XploitScan vs Burp Suite](https://xploitscan.com/alternatives/burp-suite)
- [XploitScan vs GitHub Advanced Security](https://xploitscan.com/alternatives/github-advanced-security)

## Guides and background

- [How to secure AI-generated code: a practical checklist](https://xploitscan.com/blog/how-to-secure-ai-generated-code)
- [Why traditional SAST fails on AI-generated code](https://xploitscan.com/blog/why-sast-fails-on-ai-code)
- [We ran Semgrep against our benchmark — it missed half the bugs](https://xploitscan.com/blog/semgrep-vs-xploitscan)
- [Why we don't trust our own benchmark](https://xploitscan.com/blog/why-we-dont-trust-our-benchmark)
- [Install guides (CLI, GitHub Action, Cursor, MCP)](https://xploitscan.com/guides)