cubic
Try cubic for free

Flag Security Vulnerabilities

Catches hardcoded secrets, SQL injection, XSS, weak crypto, unsafe deserialization, and plain-HTTP calls in pull requests before they ship.

Catch this in your code

What it flags

Flaggedsrc/users/search.ts
import { Pool } from 'pg';

const pool = new Pool({
  connectionString: 'postgres://admin:s3cr3t@db.internal:5432/app',
});

export async function searchUsers(req: Request): Promise<Response> {
  const term = new URL(req.url).searchParams.get('q') ?? '';
  // Credentials in source, and user input interpolated into SQL
  const { rows } = await pool.query(
    `SELECT id, name FROM users WHERE name ILIKE '%${term}%'`,
  );
  return Response.json(rows);
}
Passessrc/users/search.ts
import { Pool } from 'pg';

const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
});

export async function searchUsers(req: Request): Promise<Response> {
  const term = new URL(req.url).searchParams.get('q') ?? '';
  const { rows } = await pool.query(
    'SELECT id, name FROM users WHERE name ILIKE $1',
    [`%${term}%`],
  );
  return Response.json(rows);
}

Why it matters

Injection flaws and leaked credentials rarely look wrong in a diff: a query built with a template string reads like any other string, and a key pasted into a config file passes every test. A single injectable endpoint can expose every row the service account can read. Once a secret is committed, it stays in git history after the line is deleted and has to be rotated.

Agent instructions

cubic checks every pull request against these instructions. Paste them into AGENTS.md or Cursor rules and your AI coding tool follows them while it writes code.

AGENTS.md

Add this section to AGENTS.md at the repository root. Codex, Cursor, and other AI coding tools read it.

## Flag Security Vulnerabilities

Scan for security flaws: hardcoded secrets, SQL injection, XSS, weak auth, exposed data, poor crypto, unsafe deserialization, insecure HTTP calls in production, and more. Ensure all network requests use HTTPS/TLS. Identify attack vectors and security violations to maintain robust defenses.

Checks every changed file.

Related agents

Included in the React, Next.js, TypeScript, Node.js, Python, Django, Ruby on Rails, Go, Spring Boot, and PostgreSQL code review standards.

Run this agent on every pull request

cubic reviews every pull request against the agents you turn on and comments on the lines that break them.

Catch this in your code