A client-side code check runs before the diff exists.

Server-side scanning assumes a repository, a branch and a pipeline. That assumption holds for code that already lives somewhere your tooling can reach. It does not hold for a function pasted out of an assistant, a vendor's example file, a prompt fragment being evaluated, or a prototype that will never be committed in its current shape.

A client-side check closes that gap. The file is pasted into a page, the rules run on the text, and the answer arrives before you have decided whether the code is worth keeping.

It also removes a quiet friction. Nobody wants to add a dependency, request a token or open a pull request to find out whether a snippet is safe to run, so in practice nobody checks. Making the check free and instant is most of the value.

The rules are grouped around the ways assistant-written code fails in production rather than around language style.

Every finding carries a severity and the line that triggered it. Read the line before you read the advice, because a rule matches a pattern, not an intention: a key-shaped string in a test fixture is still worth knowing about, but it is a different conversation from one in application code.

Weight the category. A plausible secret is a rotation and a history rewrite. An unescaped interpolation is a vulnerability class. A console statement is a minute of cleanup. The report is ordered so the first group cannot hide behind the third.

Where you disagree with a rule, write down why. That is the beginning of your own house rule set, and it is also the material a reviewer needs when they look at the same file with more context.

The most expensive generated defect is not a syntax error. It is a call to a method that does not exist on the version of the library you are pinned to, written with total confidence and no autocomplete to contradict it.

A single-file check can catch the shape of the problem, such as imports that resolve to nothing inside the pasted file, and cannot check the rest because it has no notion of your installed versions.

That is a deliberate division of labour. Mechanical patterns run in the tab; dependency truth and runtime behaviour belong to your build, your type checker and your tests. The console is the first filter, not the last line of defence.

Check the snippet before you paste it into the file. Thirty seconds at that moment beats discovering a committed key in review, and it costs nothing because there is no account in the way.

Check the diff before the pull request, and attach the report when the change touches authentication, payments, data deletion or anything a customer can reach. The reviewer then starts from the findings rather than from a blank page.

Check the whole file rather than the changed lines when the assistant rewrote it. Generated refactors tend to smuggle removed error handling into untouched-looking sections, and a diff-only view hides that by design.

The tab cannot see the rest of your system. It does not know whether the endpoint you call is idempotent, whether the null you guard against can occur, or whether the authorisation on the route above yours is correct.

For those changes the escalation is a named engineer who reads the file in the context of the codebase, requests fixes and signs the verdict. They start with your automated report, so the expensive hour goes to the part that needed judgement.

That is the boundary worth keeping: patterns are cheap and should be automated, judgement is expensive and should be attributed.

Paste the whole file when you can. A fragment loses the imports, the surrounding error handling and the context that decides whether a finding matters, and the report is correspondingly less useful. The console handles a long file comfortably; it truncates at 200,000 characters and says so when that happens.

Leave out production data. A check does not need the customer table to tell you the query string is concatenated, and pasting real records into any tool creates a problem that no finding will fix. Substitute an example row with the same shape.

Treat a real credential as already compromised. If a key appears in a generated file, rotate it, revoke it and clean the history; running the check is how you found out, not the remedy. The finding is the beginning of an incident, and the label the pattern matched tells you which system to rotate first.

Finally, paste the file the assistant produced, not your tidied version. The value of the check comes from measuring what actually exists in the branch, and a cleaned-up paste will report a file you do not have.