CodeTrust Audit
A supply-chain scanner that flags AI-generated code in pull requests, fingerprints suspicious completions, and produces provenance reports so security teams can prove AI-assisted code isn't carrying backdoored patterns.
AppSec and product security teams at enterprises with developers using AI coding assistants
- PR-level scanner that highlights AI-suggested code matching known backdoor fingerprints and produces risk scores
- Shadow-AI dashboard showing which coding assistants are being used across the engineering org and by whom
- Forensic provenance report that traces a flagged completion back to likely training-data clusters and exports to audit format
- Policy engine for SOC2/ISO auditors requiring documented review of AI-generated code
New forensic research demonstrates that backdoored completions can evade existing defenses and be traced only through careful corpus analysis, and regulators are beginning to ask where AI-generated code actually came from.
Active and growing market with multiple AI-aware PR review tools emerging: Sonar launched AI code review, dev.to lists '6 Best AI Code Review Tools for 2025', open-source projects like CodeScanAI and ai-code-guard, and the Bugdar arXiv paper (2503.17302) signal real enterprise pull.The 6 Best AI Code Review Tools for Pull Requests in 2025 ↗AI Code Review Tool & Software Solution | Sonar ↗Bugdar: AI-Augmented Secure Code Review for GitHub Pull Requests ↗
No direct competitor found for AI-code provenance/attribution or backdoor-completion fingerprinting; existing tools (Sonar, Semgrep, Checkmarx, Snyk, Ox Security) target vulnerability detection and SBOM/SCA, not forensic attribution of completions to fine-tuning data — a clear niche gap.AI Code Review Tool & Software Solution | Sonar ↗Code-to-Cloud Security Starts at the Source | Ox Security ↗Pricing and Plans | AppSec Platform SAST, SCA, and Secrets ↗
Enterprise AppSec budgets exist (Semgrep, Checkmarx, Black Duck all gate pricing behind sales), but provenance is a narrow feature that incumbents could bolt on, so standalone monetization is uncertain and likely requires bundling or a marketplace/feature play rather than a full platform price.Pricing and Plans | AppSec Platform SAST, SCA, and Secrets ↗Agentic AI Cloud-Based AppSec Platform Pricing - Checkmarx ↗Top 10 Application Security Solutions for 2025 ↗
Supply-chain security is a durable concern, AI coding assistant adoption is accelerating, and regulators (EU AI Act, US executive orders) are beginning to ask for provenance of AI-generated artifacts — the underlying arXiv work ('Beware What You Autocomplete' / CodeTracer) confirms this is an emerging, not saturated, research and policy area.Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions ↗You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion ↗
Hard to build standalone: the CodeTracer approach requires access to the model's fine-tuning corpus and the miscompletion event, which third-party SaaS won't have for GitHub Copilot/Cursor; AI-generated code detection itself is an unsolved research problem, and PR/CI integration across GitHub, GitLab, Bitbucket adds engineering surface — feasible as a thin detector, but a stretch as a true attribution/forensics product.Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completions ↗