A lightweight, privacy-first tool that helps developers identify risky AI-generated code by detecting hallucinated APIs, oversimplified implementations, and structural red flags—entirely within the browser.

🌐 Live Demo: https://code-or-scam.vercel.app

Code or Scam? is a browser-based code analysis tool designed to help developers spot high-risk patterns commonly found in AI-generated code.

Modern AI coding assistants can generate code that appears correct but fails in practical environments due to hallucinated APIs, unrealistic assumptions, missing validation, or overly simplified examples. This project focuses on identifying those warning signs before they become costly debugging sessions.

All analysis happens locally in your browser—your source code is never uploaded, stored, or tracked.

AI-assisted programming has dramatically improved developer productivity, but it has also introduced new risks.

Examples include:

• Hallucinated APIs and libraries that do not exist.
• Demo-only implementations that omit production safeguards.
• Missing validation and error handling.
• Unrealistically simple code that ignores edge cases.
• Incorrect language-specific syntax patterns.

Code or Scam? helps developers quickly identify these issues while preserving privacy through entirely client-side execution.

• Detects risky AI-generated code patterns.
• Supports 9 programming languages:
  • Python
  • JavaScript
  • Java
  • C
  • C++
  • Rust
  • Go
  • C#
  • Solidity
• Identifies hallucinated APIs and suspicious libraries.
• Detects common syntax mistakes (such as missing Python f-string prefixes).
• Provides instant analysis with no server requests.
• Runs completely offline after loading.
• Mobile-friendly interface built and tested on Android.

1. Paste your source code into the analyzer.
2. The application detects the programming language using structural heuristics.
3. Language-specific validation rules inspect the code for common syntax mistakes.
4. AI-focused heuristics identify suspicious APIs, unrealistic implementations, and structural warning signs.
5. Results are displayed instantly in the browser.

No source code is transmitted over the internet during analysis.

Privacy is a core design principle.

• No user accounts.
• No analytics.
• No cloud processing.
• No source code uploads.
• No tracking.

Everything executes locally inside your browser.

The analyzer currently looks for patterns such as:

• Hallucinated APIs
• Suspicious library names
• Missing validation
• Unrealistic simplicity
• Common syntax mistakes
• Structural code red flags

Note

Code or Scam? does not attempt to determine whether code was generated by AI. Instead, it focuses on identifying high-risk patterns that frequently appear in AI-assisted code generation.

.
├── index.html
├── css/
├── js/
├── assets/
└── README.md

Clone the repository.

git clone https://github.com/Josh-Fynly/code-or-scam.git

Navigate into the project.

cd code-or-scam

Open index.html in your browser or serve it using your preferred local development server.

Future improvements may include:

• More language-specific analysis rules.
• Configurable warning severity.
• Exportable analysis reports.
• VS Code extension.
• Browser extension.
• Plugin architecture for custom rule sets.
• Additional programming language support.

This project is open source under the MIT License.

Bug reports, feature suggestions, and pull requests are welcome.

Josh Fynly

Backend Software Engineer

GitHub

https://github.com/Josh-Fynly

Portfolio

https://my-portfolio-zfrw.vercel.app

LinkedIn

https://linkedin.com/in/joshua-ekpenyong-014014340

Built with precision. Privacy-first. 100% Client-side.