AI-code audit (origin + segregation + attestation)
Vulkro can tell you which findings sit on AI-generated code, and stamp those findings with a human-review sign-off for audit evidence.
vulkro scan . --ai-code-segregation
vulkro scan . --attest-reviewed --reviewer security-lead
How origin is detected
Vulkro looks for explicit markers that AI tools leave in files:
| Tool | Markers |
|---|---|
| Claude | Generated by Claude, Generated with Claude, Co-Authored-By: Claude, @claude-generated, @anthropic-generated |
| GitHub Copilot | GitHub Copilot, Copilot-generated, @copilot |
| Cursor | cursor.sh, @cursor-generated |
| Aider | aider:, // aider |
| ChatGPT | Generated by ChatGPT, OpenAI GPT-... |
| Generic | AI-generated, Generated by AI, # generated by ..., // generated by ... |
A file with no marker counts as hand-written. Vulkro does not guess from code style.
--ai-code-segregation
Prints a Markdown report to stderr after the scan: total findings, how many sit on AI-touched files, a per-tool breakdown, and each AI-touched file's share of marker lines. The main output (table, JSON, SARIF) is unchanged.
# Vulkro AI-Code Segregation Report
- Total findings: 42
- Findings on AI-touched files: 11 (26.2%)
## Per-tool breakdown
- claude: 7 finding(s)
- copilot: 3 finding(s)
- generic-ai: 1 finding(s)
--attest-reviewed
Adds a human-reviewed-ai-code evidence row to every finding on an AI-touched file, with the reviewer name (--reviewer NAME, default $USER). The row carries into JSON, SARIF and JUnit, so a compliance report can show that every AI-touched finding was reviewed.
For audit evidence, combine both and keep the SARIF:
vulkro scan . --ai-code-segregation --attest-reviewed --format sarif > scan.sarif
--ai-pr
For CI lanes that scan changes written by AI coding agents. When at least two of four signals fire on the latest commit (a large diff, new files without tests, repetitive doc comments, AI markers in the commit message), access-control findings move up one severity tier and get an ai-pr tag, and Low-confidence findings are hidden.
See also: vulkro scan