AI Guardrail
Catches the mistakes AI coding assistants actually make — as you type.
AI-generated code looks right. That's the problem. It imports packages that don't exist, inlines API keys to "make it work", and reaches for innerHTML because the training data did. AI Guardrail underlines these in your editor before they reach a commit.
Your code never leaves your machine
Scanning is fully local. The only things that ever leave your editor:
- Package names — checked against the npm registry to catch hallucinated dependencies
- Rule metadata — only if you explicitly send feedback (rule key, verdict, engine version — never code)
No telemetry, no code upload, no exceptions.
What it catches
| Rule |
What it finds |
hallucinated-dependency |
Imports of packages that don't exist on npm, plus known typosquats (raect, loadash, …) with the correct name suggested |
client-secret-leak |
OpenAI, Anthropic, Stripe, AWS, GitHub, Google, Slack keys and private key blocks committed into client code |
jwt-in-client |
JSON Web Tokens pasted into source |
unsafe-render |
innerHTML, dangerouslySetInnerHTML, document.write, v-html and friends |
Rules are live data, not extension code. They're maintained centrally and improve without extension updates. False-positive fixes reach you the moment they're published.
Getting started
Install, open a JS/TS project, done. The free ruleset loads anonymously — no account, no configuration.
Team setup
If your organization manages its own rules on UP2YOU:
- Set
aiGuardrail.tenantId to your organization's tenant ID (your admin gives you this)
- Create an API key at up2you.app → Profile → API keys. Scope it to the AI Guardrail workspace so
the key only reaches that app's data. The key is shown once — copy it.
- Run AI Guardrail: Connect with API Key from the command palette and paste it
- The status bar shows
AG: N rules (org) — your org's rules now apply on top of the free set
Your UP2YOU password is never stored in the editor. Revoke a key any time from the same screen; the
extension stops working within 24 hours and nothing else on your account is affected.
Found a false positive? Open the lightbulb menu on the finding → Report false positive. Your admin sees it in the panel.
Suppressing a finding
// ai-guardrail-disable-next-line
// ai-guardrail-disable-next-line client-secret-leak
// ai-guardrail-disable-line client-secret-leak -- test fixture, AG-214
Set aiGuardrail.suppressMode to strict to require a justification after -- — suppressions without one are void.
Settings
| Setting |
Purpose |
aiGuardrail.tenantId |
Organization tenant for licensed rules (empty = free feed) |
aiGuardrail.ignore |
Extra path segments to skip (build output is skipped by default) |
aiGuardrail.suppressMode |
simple (default) or strict |
Build output (node_modules, dist, .next, bundles, minified files) is never scanned. Offline? The last fetched ruleset keeps working from cache; the status bar tells you.
For organization admins
Rule management lives in your UP2YOU panel: create and edit rules with a form, import rule packs, review member feedback, publish changes that reach every editor instantly. See the Docs tab in your app panel for the full guide.
