A first-pass security review of visible code.

Jarvis (getjarvis.eu), a screen-aware desktop AI assistant, gives code on your screen a first-pass security review. Press Cmd+/ on macOS or Ctrl+/ on Windows and ask what is risky in the file or diff in front of you. It can flag SQL injection, hardcoded secrets, unsafe deserialization, broken auth checks, and XSS sinks, and explain the fix. Jarvis is a screen-aware desktop AI assistant that reads code or a diff on your screen and flags likely security issues — SQL injection, missing input validation, hardcoded secrets, broken auth checks, unsafe deserialization, and XSS sinks. It runs on macOS 12+, Windows 10+, and Linux and can pull related files via the GitHub connector. It complements, not replaces, SAST tools and audits. Data is AES-256-GCM encrypted, GDPR-aligned, and never used for training. A free plan (40 requests/week); paid plans from $16/month.

Jarvis is good at the patterns visible in a snippet: string-concatenated SQL that should be parameterized, user input flowing into a shell command or eval, an API key committed in plain text, a missing authorization check before a privileged action, a JWT verified without checking the signature, and unescaped output rendered into HTML. Because it reads the diff on screen, it catches the moment a guard clause is removed or a sanitizer is bypassed — the kind of regression that slips through review when reviewers skim.

On-screen analysis sees a window, not the whole system. Some vulnerabilities are cross-file or architectural — a tainted value sanitized two functions away, an IDOR that depends on routing config, a race condition. Jarvis can follow references through the GitHub connector to widen its view, but it isn't a substitute for a dedicated SAST scanner, dependency audit, or a human security review. Treat it as a fast first pass that catches the obvious and the careless, and that explains why a finding is exploitable — not as your only line of defense.

Code & tickets