你在AI安全错误发布之前就将其拦截。
在本地运行Shoulder，几秒内看到真实漏洞，在它们到达生产环境之前修复。
我们处于早期阶段。结果有时会不正确。您的反馈塑造我们接下来要修复的内容。
npm install -g @shoulderdev/cli
查看真实影响
检查漏洞或扫描 GitHub 仓库
粘贴一个包、CVE 或 GitHub URL
What you can scan in beta today
Shoulder is in active development. These are the languages and ecosystems we support right now — everything else is on the roadmap.
- JavaScript
- TypeScript
- Python
- Go
- npm
- PyPI
- Go modules
- Detecting auth removal and route exposure changes in JavaScript / TypeScript
- Showing source → sink data flows on supported routes
- Catching packages with active malware or critical alerts on npm and PyPI before install
- Flagging dormant packages that suddenly change maintainers, add install scripts, or pull in new transitive risk
- Detecting capability changes — shell, network, env-var sweeps, dynamic eval — introduced in new versions
- Resolving version specs (e.g. ^4.2.0) to the release that actually installs, then checking that release against ecosystem intel
- Surfacing install scripts, obfuscation, account age, and maintainer-risk signals on each dependency
- Coverage outside web frameworks and HTTP routes
Working on something else?
We are expanding language and ecosystem coverage with our design partners. If your stack is not in the list, work with us directly to shape what comes next.
AI提高了你的产出。也提高了你的风险。
AI 提高了产出，但不会提高人工审查的深度。信任就在这道缝隙里断裂。
- 一个 diff、一个重命名函数和一个通过的测试
- 在更大系统里改动的少数几个文件
- 单独看起来还算合理的代码
- 看见私有路由何时变成公开路由
- 知道你的各个端点何时失去认证覆盖
- 在可疑依赖执行前把它们拦下来
- 把不可信输入追踪到数据库、shell 和 eval
少花时间猜测一个改动是不是吓人，多一些把握知道它到底改了什么。
为你实际的工作方式而设计
你用AI来加速。AI可能会无验证序列化、绕过认证检查、引入注入路径、使用弱随机数。Shoulder捕获AI遗漏的问题，让你自信地发布。
Removed auth from an export endpoint
A small diff can quietly turn an admin-only action into a public attack path. This is the gap Shoulder closes.
app.post('/admin/export', exportData) replaces app.post('/admin/export', requireAuth, exportData).
The route loses its auth guard and becomes reachable from an unauthenticated request path.
Auth coverage drops and a previously protected data export becomes a new public capability.
Flag the change before merge, show the exact route affected, and block the release until access control is restored.
你不是在审查AI的输出。
你是在验证它实际做了什么。
生态系统信任情报
根据维护者历史、下载异常、安装脚本和已知恶意软件信号检查任何软件包。
了解每次变更实际做了什么。
你查看代码和依赖项中的漏洞。你获得清晰的修复指导。
透明建立信任
你可以在安装前阅读Shoulder的工作原理。我们公开检测逻辑。我们记录每条规则。我们解释每个决策。
AI提升速度。Shoulder提升掌控力。
安装CLI。几秒内开始扫描。成为快速行动又保持安全的开发者。
npm install -g @shoulderdev/cli