wtf is hallint?

hallint is a static analysis tool built specifically to catch the security and quality mistakes that AI coding assistants like Copilot and Cursor tend to leave behind. Standard linters such as ESLint or Pylint were built to catch style problems and common logic errors in code written by people, but they were not designed for the specific failure patterns of AI generated code, so hallint focuses on those patterns instead. The tool looks for things like hardcoded secrets such as API keys or passwords left directly in source files, SQL injection where user input is pasted straight into a database query, missing authentication checks on route handlers, unsafe use of eval or dynamic function construction, cross site scripting through unsanitized strings assigned to innerHTML, overly permissive CORS settings, and storing authentication tokens in local storage where they are easy to steal. It also flags subtler problems, like route handlers that look like they have authentication wired up but do not, and async functions with no error handling that can silently swallow failures. hallint is written in TypeScript and requires Node.js version 18 or later. It can be installed globally as a command line tool, added as a library to import in your own tooling, or run without installing at all using npx. Running it against a folder of source files prints a list of findings with file names, line numbers, severity levels, and suggested fixes, plus a summary count at the end. Findings can be filtered by minimum severity, and there is an option to disable color output for logs or continuous integration pipelines. The exit code changes depending on whether critical or high severity issues were found, which makes it straightforward to fail a build automatically. As a library, hallint exposes a scan function for checking files matching a glob pattern and a scanSource function for checking a string of code directly in memory, which is useful for editor plugins or automated tests. The project is released under the MIT license.