# AI Code Review & Security — AI Coding Tool Review & Pricing

> Security-audit is a coding-agent skill that transforms your existing AI coding agent into a structured security auditor by orchestrating isolated sub-agents. It performs a six-phase audit process including reconnaissance, coverage-led hunting, and adversarial validation to identify and verify security vulnerabilities within a codebase.

Source: https://ai.dosa.dev/tools/security-audit · Updated Nov 1, 2026 · Category: AI Code Review & Security · Published by dosa.dev

## At a glance

- **Tool**: AI Code Review & Security
- **Company**: Cloudflare
- **Category**: [AI Code Review & Security](https://ai.dosa.dev/category/code-review)
- **Pricing model**: Free
- **Official website**: https://github.com/cloudflare/security-audit-skill

## Key features

- Six-phase structured audit workflow
- Adversarial validation with independent verifier agents
- OS-enforced sandboxing for secure code execution
- Support for multiple target-specific attack classes
- Evidence-backed findings with source traces

## Pricing

**Model**: Free

The tool is free and open-source under the MIT license, though users are responsible for the model usage costs incurred by the coding agent running the multi-agent workflow.

## Who it is for

- **Best for**: Systematic, coverage-led vulnerability hunting in codebases where you own the source and want to minimize hallucinations through multi-stage validation.
- **Not ideal for**: Projects exceeding 50,000 lines of code without a significant compute budget, or for testing live production services, shared environments, and endpoints.

## Verdict

A robust, transparent starting point for teams looking to build an AI vulnerability harness, though users should be prepared for substantial compute costs and potential gaps in deep-dependency or complex multi-repository auditing.

## Recent updates

The repository received significant updates on September 10, 2026, which reworked the audit workflow, findings contract, and validators. Subsequent commits on September 14, 2026, clarified the distinction between guidance and full audit modes.

## Frequently asked questions

### Is AI Code Review & Security free?

Yes - AI Code Review & Security is Free. The tool is free and open-source under the MIT license, though users are responsible for the model usage costs incurred by the coding agent running the multi-agent workflow.

### Is AI Code Review & Security open source?

AI Code Review & Security is not listed as open source on ai.dosa.dev - it is Free.

### Who is AI Code Review & Security best for?

Systematic, coverage-led vulnerability hunting in codebases where you own the source and want to minimize hallucinations through multi-stage validation.

### Who is AI Code Review & Security not ideal for?

Projects exceeding 50,000 lines of code without a significant compute budget, or for testing live production services, shared environments, and endpoints.

### What are the best AI Code Review & Security alternatives?

The closest AI Code Review & Security alternatives on ai.dosa.dev are CodeRabbit, Qodo, Snyk Code - all listed under AI Code Review & Security.

### Who makes AI Code Review & Security?

AI Code Review & Security is developed by Cloudflare. It is listed in the AI Code Review & Security category on ai.dosa.dev.

## Top alternatives

- [CodeRabbit](https://ai.dosa.dev/tools/coderabbit) (Freemium) — Engineering teams and organizations that utilize AI coding agents and require a central governance layer to validate, prioritize, and secure high-velocity code output.
- [Qodo](https://ai.dosa.dev/tools/qodo-qodo) (Paid) — Enterprise engineering teams needing to enforce consistent coding standards and governance across multiple repositories, Git providers, and large-scale agentic workflows.
- [Snyk Code](https://ai.dosa.dev/tools/snyk-code-snyk) (Freemium) — Developers and DevOps teams looking for fast, integrated security scanning that reduces remediation time by automatically suggesting fixes for source code vulnerabilities.
- [cubic](https://ai.dosa.dev/tools/cubic) (Freemium) — Development teams managing complex, multi-file codebases who need repository-wide context and automated, remediation-focused security and bug detection.
- [Kodus](https://ai.dosa.dev/tools/kodus) (Freemium) — Mid-sized to enterprise teams that require highly customizable, context-aware code reviews and automated policy enforcement with strict data privacy requirements.
- [Gito](https://ai.dosa.dev/tools/gito) (Open Source) — Engineering teams prioritizing data privacy and vendor neutrality, open-source maintainers, and developers seeking automated, consistent quality checks.
- Full alternatives guide: https://ai.dosa.dev/tools/security-audit/alternatives