zyoffsec/airtight-secure-coding

Airtight is a set of secure coding checks meant to run alongside AI coding assistants like Claude Code, Cursor, and Codex. The problem it addresses is subtle: when you ask an AI model to write a feature, it usually gets the obvious security basics right, like validating input or using a parameterized database query, but it tends to skip the checks nobody explicitly asked for, such as blocking a user from sneaking an admin role into a request meant only to update their username. Airtight works as a set of 67 individual checks, called gates, spread across 13 topics that map to the OWASP Top 10 and the CWE weakness list. Each gate is a strict pass or fail, and any issue found points back to a specific numbered gate. The README includes a measured comparison: in a test where two AI agents were given the same login feature to build, one with Airtight and one without, the version using Airtight passed 25 out of 26 applicable gates, while the version without it passed only 16. The gaps in the unprotected version were not broken cryptography, they were missing defaults like no rate limiting, no account lockout, error messages that leaked stack traces, and no security logging. Installation is a single command that adds it as a skill for supported AI coding tools, or you can clone it directly into a skills folder. Once installed, it is meant to run silently in the background as you write code, with no command needed to trigger it. There are also manual commands available: one to audit existing code against the gates without changing anything, one to automatically find and fix failing gates, and one to test code with deliberately tricky edge case input. The README is explicit about its limits: it does not catch business logic bugs, unknown vulnerabilities in your dependencies, or broader architecture problems, since those still need a human reviewer. It is licensed under the MIT license.