Add Vitest for unit tests, Playwright for browser tests and TypeScript strict mode, then run them in GitHub Actions on every push. Turn on Dependabot and GitHub secret scanning, scan for leaked keys with TruffleHog or Gitleaks, check code with Semgrep, and audit pages with Lighthouse and axe. Scan a running app with OWASP ZAP only if you own it.
AI writes code quickly and confidently, including code that is wrong or unsafe. These free tools are the checks a human reviewer would run: tests that fail when a rule breaks, scanners that find leaked keys and weak patterns, and audits for speed and accessibility.
The 16 picks
Swipe or use the arrows.
Free, MIT licenceVitest
A fast unit and component test runner for Vite apps with a Jest-compatible interface. Free under MIT. Ask your AI tool to draft tests, then break a rule on purpose to prove a test fails.
Free, Apache-2.0Playwright
End-to-end tests that drive real Chromium, Firefox and WebKit browsers. Free under Apache-2.0. It downloads browser files of several hundred megabytes and can generate tests from a recording.
Free, Apache-2.0TypeScript strict mode
A compiler setting that catches many type mistakes in AI-written code. TypeScript 7.0 turns strict on by default; on older versions set strict to true yourself.
Free, MIT licenceESLint
Finds bugs and bad patterns in JavaScript and TypeScript. Free under MIT. Version 10 uses a flat config file, so older .eslintrc tutorials no longer apply.
Free for public reposGitHub Actions
Runs your tests and scanners on every push. Standard runners are free for public repositories, and the free plan includes a monthly compute allowance for private ones. Check your billing page.
Free on GitHubDependabot
Raises alerts for vulnerable dependencies and opens pull requests with fixes. Included on GitHub's free plan. Group the updates and review them rather than merging blindly.
Free, built into npmnpm audit
A built-in npm command that checks your dependency tree for known vulnerabilities. Free and needs no setup. npm audit fix can change versions, so review the changes.
Free, Apache-2.0OSV-Scanner
Google's scanner that checks your lockfiles against the open OSV vulnerability database. Free under Apache-2.0 and run from the command line or CI.
Free on public reposGitHub secret scanning
Detects known key formats in your repositories and can block a push that contains one. Free on public repositories; private repositories need a paid plan. It misses some secret types.
Free, MIT licenceGitleaks
Finds API keys and passwords in git history and files, and can run as a pre-commit hook. Free under MIT, but now in maintenance mode, and its maintainers point new users to a successor called Betterleaks.
Free, AGPL-3.0TruffleHog
Secret scanner that recognises over 800 secret types and can check whether a found secret is still live. Free under AGPL-3.0. Live checking contacts the provider, so use it deliberately.
Free engine, free cloud tierSemgrep
Static analysis that finds insecure code patterns. The Community Edition engine is open source under LGPL-2.1, and the free cloud plan covers up to 10 contributors.
Free for public reposCodeRabbit
An AI reviewer that comments on pull requests. Free for public repositories; private repositories get a 14-day trial. Your code goes to its service, and AI review misses bugs, so it complements tests.
Free, Apache-2.0Lighthouse
Audits performance, accessibility, SEO and best practices in Chrome DevTools or PageSpeed Insights. Free under Apache-2.0. Run it on a production build, not a dev server.
Free, MPL-2.0axe-core
Accessibility engine used inside Lighthouse, with a free axe DevTools extension from Deque. Open source under MPL-2.0. Automated tools find only part of the accessibility problems in a page.
Free, Apache-2.0OWASP ZAP
A free scanner and proxy that tests a running web app for problems such as injection and cross-site scripting. Apache-2.0. Only scan sites you own or have written permission to test.
Compare in a table
Show the full comparison table
| Tool | Best for | Free plan |
|---|---|---|
| Vitest | Unit tests in Vite apps | Free, MIT licence |
| Playwright | Testing sign-in and key flows | Free, Apache-2.0 |
| TypeScript strict mode | Stopping type errors early | Free, Apache-2.0 |
| ESLint | Catching bugs before they ship | Free, MIT licence |
| GitHub Actions | Automatic checks on each push | Free for public repos |
| Dependabot | Updating risky packages | Free on GitHub |
| npm audit | A zero-setup dependency check | Free, built into npm |
| OSV-Scanner | A second dependency check | Free, Apache-2.0 |
| GitHub secret scanning | Blocking leaked keys | Free on public repos |
| Gitleaks | Catching keys before you push | Free, MIT licence |
| TruffleHog | Finding and verifying leaks | Free, AGPL-3.0 |
| Semgrep | Finding insecure patterns | Free engine, free cloud tier |
| CodeRabbit | AI review on open-source repos | Free for public repos |
| Lighthouse | Speed, SEO and accessibility scores | Free, Apache-2.0 |
| axe-core | Automated accessibility checks | Free, MPL-2.0 |
| OWASP ZAP | Scanning your own live app | Free, Apache-2.0 |
Get started this week
- Add Vitest and write one test for a rule that must never break.
- Turn on Dependabot and secret scanning in your repository settings.
- Run Lighthouse on the live page and fix the top accessibility issue.
How to choose
- Write three tests first: signed-out users cannot read private data, user A cannot read user B's data, and bad input is rejected.
- Run every check in GitHub Actions so nothing depends on you remembering.
- Scan for secrets before the first push, and rotate any key that was ever exposed.
- Use automated tools as a floor, not a finish line: they miss logic errors and many access-control flaws.
Free plans change. Limits above were checked on 3 Nov 2026; confirm on each tool's pricing page before relying on them.
Frequently asked questions
How do I test AI-generated code?
Write tests for the rules that must never break, such as who can see whose data, then run linting, type checks and a dependency audit. Break a rule on purpose and confirm a test fails.
Do I need security tools for a small student project?
Yes, a few. Secret scanning and a dependency audit take minutes and catch the most common mistakes in AI-written code: committed keys and vulnerable packages.
Which free tool finds leaked API keys?
GitHub secret scanning for public repositories, plus TruffleHog or Gitleaks on your machine. If a key ever leaks, rotate it; deleting the commit is not enough.
Can OWASP ZAP break my app?
It can generate heavy traffic and false alarms. Run it against a test copy you own, never against someone else's site without written permission.
Learn this with mentors
Programmes for builders and engineers with admissions open: live classes, mentors and project work.
