Last month a junior developer on a client project pushed a SQL query that concatenated user input straight into the WHERE clause. Classic injection. The pull request had two approvals from senior engineers. Nobody caught it.
This is not unusual. Code review catches logic bugs, style violations, missing tests. It is not great at catching security patterns. Reviewers scan for intent and correctness - does this code do what it is supposed to do. They are not running OWASP categories through their head while reading a diff.
AI-generated code makes this worse, not better. Copilot and Claude write code fast, and they write vulnerabilities at roughly the same rate as human developers. The volume goes up, the review time per line goes down, and the gap between “code that works” and “code that is safe” gets wider.
What we did about it
I built AIVory Guard as a JetBrains plugin that scans diffs in real time. Open a file, edit it, and the plugin highlights security issues inline - the same way your IDE shows syntax errors. No context switch, no separate tool, no waiting for a CI pipeline.
It catches the OWASP Top 10 for LLM applications and web applications: injection, XSS, command injection, path traversal, hardcoded secrets, insecure deserialization. The things that humans miss because they are not thinking about security while reviewing a feature implementation.
The way it works: the plugin reads your local diff, sends the changed code to a model that is trained on vulnerability patterns, and gets back a list of issues with line numbers and explanations. The whole round trip takes a few seconds. You see the warning before you commit.
What it does not catch
It is not a full security audit. It does not understand your business logic. It will not tell you that your authorization model has a gap or that your session handling is wrong in a way that only makes sense in context. It catches patterns - the low-hanging fruit that accounts for the majority of real-world breaches.
It also has false positives. A string concatenation that looks like injection but is actually building a log message. A hardcoded string that looks like a secret but is a test fixture. We tuned the model to reduce these, but they happen. Better a false positive you dismiss than a real vulnerability you miss.
Setup
Install the plugin from the JetBrains Marketplace, configure your API key, and it runs. The free tier gives you 50 scans per week, which is enough to see if it catches things your team misses.
For the SQL injection that started all of this: Guard would have flagged it inline the moment the developer typed the query. Before the commit, before the PR, before two senior engineers approved it. That is the point - catch it early, when fixing it costs nothing.