What's under the hood, because "AI security scanner" do deserves the suspicion. We use opensource security tools (the security engine), 29 security rules that I wrote for the most patterns that show up specifically in AI-generated code :
RLS, Secrets, Buckets, Auth, Mass-assignment, Webhooks, CORS, Debug, Randomness, Ownership and Vulnerable dependencies
Our AI layer does two jobs and neither is finding bugs. It reviews CRITICAL and
HIGH findings for false positives and it writes the fix. Everything that
detects anything is deterministic.