Hi, I'm Théo. I'm a self-taught developer and I build most of my projects with AI tools like Claude Code.

AI tools are great at making an app that works. But "it works" is not the same as "it's safe". When I looked at my own projects, and at a lot of AI-generated code shared online, I kept seeing the same mistakes:

  • an OpenAI, Anthropic or Stripe key written directly in the code, or still in the git history
  • a secret key put in a NEXT_PUBLIC_ or VITE_ variable, so it ships to the browser
  • Supabase tables without Row Level Security, or with using (true) policies
  • Firebase rules that let anyone write
  • API routes that call a paid AI API or use the service_role key without checking who is calling
  • a committed .env file

So I built Garde-Fou (French for "guardrail"). It's a small CLI that checks for these problems before you ship.

How to try it

In your project folder:

npx @gardefou/cli

You get a score out of 100 and a list of problems, most serious first. For each one: why it's dangerous, how to fix it, and a prompt you can paste into Cursor, Lovable, Bolt or Claude Code so it fixes it for you. --html gives you a report page instead.

A few choices I made

  • It runs on your machine. It doesn't change your files and doesn't send your code anywhere.
  • Detection doesn't use AI. The rules are deterministic. I'd rather miss something than show false alarms.
  • The only network call is the dependency check on OSV.dev (package names and versions only). --offline turns it off.
  • There's also an MCP server (npx @gardefou/cli mcp) so an AI agent can run the scan itself, and a GitHub Action for pull requests.

It's early

It's free and open source (MIT). It only covers the mistakes I see most often, and I'm sure it has gaps and false positives.

I'd really like your feedback:

  • What did it miss in your project?
  • Did it flag something that was actually fine?
  • What check would you add first?

GitHub: https://github.com/theojoyerclement-crypto/garde-fou

Thanks for reading.

English is not my first language, so I used AI to help me write this post.