Security Tooling
llm-audit
An open source static analysis tool for LLM application code. Rules mapped to the OWASP LLM Top 10, run at commit time. Published on npm.
The problem
Wiring up an LLM introduces a specific class of security bug. Hardcoded provider keys. Model output parsed without a schema. Untrusted input reaching a tool call. AI assistants write most of them, people write the rest, and no linter was looking for any of it.
The solution
A Semgrep rule pack and CLI that catch them before the commit lands. Every finding carries its OWASP mapping, the risk, and the fix. Output is plain text, JSON, SARIF, or a standalone HTML report you can hand to someone who does not read terminals. Each rule ships with a vulnerable fixture and a safe one, so the rules are tested the same way the code is.