Developer Builds Open-Source AI Code Reviewer After Finding It Missed SQL Injection Flaws

A developer built EdgeGuard, an open-source VS Code extension designed to detect security vulnerabilities in code from an adversarial perspective. During early testing against the OWASP Java Benchmark, the tool produced false negatives because the underlying AI model made optimistic assumptions about unknown helper functions, incorrectly marking tainted data as safe. To fix this, the developer revised the analysis strategy so the AI preserves taint status through unknown functions unless explicit evidence of sanitization exists, shifting from guesswork to evidence-based reasoning. A local static risk screening stage was also added to filter out low-risk functions before any API calls are made, reducing both cost and rate-limit issues. These changes significantly improved EdgeGuard's ability to trace potentially dangerous data flows, such as unsanitized HTTP input reaching SQL queries.