AI wrote it.
Nobody checked it.
openaudit checks what you ship for security holes, leaked keys, slow pages and accessibility problems. Then it hands your AI the list to fix.
Copies a one-line prompt for Claude Code, Cursor, Codex, Windsurf or Copilot.
What gets copied?
Audit this project with openaudit (https://openaudit.se/llms.txt). Fix what matters most, then run it again to check.
- Free
- Open source
- Runs on your machine
Its own score, every push: 100/100
The problem
AI ships fast. Its mistakes ship too
Your AI writes code that works. It doesn't check that it's safe, and you can't tell by looking.
A key left in the code
An API key gets pasted in to make something work. Someone finds it and runs up the bill on your account.
A door nobody locked
The admin page works, so it ships. Nothing checks who's asking, so anyone with the link gets in.
A site some people can't use
Buttons a screen reader can't name, text too faint to read. In the EU, the Accessibility Act has applied since June 2025.
How it works
Hand it over. Get it fixed
Hand it to your AI
Paste one sentence into the agent you already use. It installs openaudit and runs it on your project.
It checks everything
103 checks and 52 free scanners look at your code, your site and what you depend on. Every problem gets a plain fix.
Your AI fixes it, then checks again
It works through the list, most serious first, and runs the audit again to prove the fixes landed.
- Audit this project with openaudit (https://openaudit.se/llms.txt). Fix what matters most, then run it again to check.
- openaudit run_audit target: "."
- 78/100, grade C. 1 critical and 3 high findings from 41 auditors.
- openaudit get_playbook id: "agent.authz"
- Authentication and authorization review: inventory every route, then check who can reach it.
- Read src/routes/admin.ts
- openaudit submit_findings 2 findings
- Merged into the report. Security 61 to 54.
- Edit src/routes/admin.ts, src/config.ts
- openaudit compare_reports
- 3 fixed, 0 new.
What you get
A report anyone can read
One grade per area and a plain fix for every finding. Its Copy for AI button hands the whole thing to your chat.
Open the live reportFree
No account, no key, no plan to pick. The AI features cost tokens, and they're opt-in.
Open source
MIT licensed. Read the licence or the code.
Runs on your machine
Your code stays with you. Only lookups like known vulnerabilities go out.
Never runs what it scans
Every project is treated as hostile. The safety model
Questions
Do I need to know how to code?
No. Your AI runs it, reads the results and makes the fixes. You can open the report yourself too: every finding says what's wrong and how to fix it, in plain words. Works in Claude Code, Cursor, Codex, Windsurf or Copilot.
Does it upload my code?
No. It runs on your machine. Dependency checks ask OSV.dev and URL audits call the site you name. --offline stops the rest. Code only leaves if you turn on the agentic auditors.
What does the grade mean?
Each area gets a score from 0 to 100, and every problem costs points by how serious it is. 90 or more is an A. One critical problem takes an area to 50. How scoring works
What do I need installed?
Just Bun 1.4+, and your AI can install that. The other 52 scanners are used when installed and skipped when not. The Docker image has them all.
Is it free?
Yes. MIT licence and free scanners. The AI features cost tokens, and they're opt-in.
Put it to work
Copies a one-line prompt for Claude Code, Cursor, Codex, Windsurf or Copilot.
What gets copied?
Audit this project with openaudit (https://openaudit.se/llms.txt). Fix what matters most, then run it again to check.