Independent verification for AI-authored code
Verify
AI-authored fixes
Your AI fixed it. We check whether it actually did.
AI writes and merges its own security fixes now. We’re the independent check that the hole actually closed, before it ships.
Currently testing SQL injection fixes · Scoring is live
Every other check was green.
Why independent
The one thing a fixer can never sell you.
An author cannot grade their own work. Every AI fixer today does exactly that, checking its patch against the scanner it was written to satisfy. Assay is the independent party, and that is not a feature anyone can add: it is about who does the looking.
The evidence
How the fixes held up.
We tested patches against SQL injection attacks and normal inputs. A fix has to stop the attack and keep the application working.
| Provider / tool | Patches scored | Blocked all attacks | Preserved behaviour | Verified |
|---|---|---|---|---|
| ChatGPTChatGPT Think | 4 | 4/4 | 3/4 | 3/4 |
| Claude Code2.1.270, Opus 5 | 4 | 4/4 | 3/4 | 3/4 |
| GitHub Copilot AutofixCodeQL 2.27.0, default suite | 2 | 2/2 | 1/2 | 1/2 |
Small pilot, not a general ranking. Only scored patches count; “no alert” cases are excluded. These are tested tools, not partners.
Inspect the evidence ↗Your workflow
Keep your fixer.
Check its work.
Bring a patch from the tool you already use. Assay checks what changed.
- 01
Bring a patch
Choose a SQL challenge. Give it to your AI tool, then bring back the fix.
- 02
Run the checks
Check the scanner alert, unseen attacks, normal inputs and suppressed warnings.
- 03
Inspect the verdict
See which checks passed, which failed and the evidence behind the result.
Benchmark scoring is live. Automated checks on your own pull requests are in development.
Where this leads
One fix at a time, for now.
As AI writes more of the world’s code, every change it makes will need an independent record of what it actually did. That record is what oversight means, and it is the kind of record regulation begins to require from December 2027.
We started with SQL injection because it is measurable. The method is the point.
Start with one fix
Put a patch to the test.
Four SQL injection challenges. Real checks. Evidence you can inspect.