# Scanning AI-Generated JavaScript and TypeScript

AI assistants write as much JavaScript and TypeScript as they write Python, and the same failure modes ride along: a hardcoded token in a config file, an unsafe pattern copied from a tutorial, an npm package that doesn't exist. BrassCoders scans the JS/TS in your project automatically, using a real parser rather than a pile of regexes, in the same pass as the Python scan.

## JS/TS Runs in the Same Scan

BrassCoders includes a JavaScript/TypeScript scanner that activates on its own when a scan finds `.js`, `.ts`, `.jsx`, or `.tsx` files, parsing them with a Node.js Babel parser and checking the AST for secrets and common security patterns. There's no separate command and no separate config; the JS/TS findings land in the same `.brass/` output as the Python ones, tagged by scanner.

That matters for the mixed repo, which is most repos now. A FastAPI backend with a React front end, a Python service with a TypeScript CDK stack — BrassCoders walks both languages in one run instead of leaving you to stitch a Python scanner and a JavaScript scanner together in CI.

## Why a Babel Parse Beats a Regex

BrassCoders parses JavaScript and TypeScript into an abstract syntax tree with [Babel](https://babeljs.io/) rather than matching raw text, so a finding tracks the structure of the code instead of its formatting. A regex for a dangerous call breaks the moment someone renames a variable, reflows the lines, or wraps the call differently. An AST match doesn't.

The parse also kills a whole class of false positives. A text search for a credential pattern fires inside comments and string literals that aren't credentials; an AST-aware check knows whether it's looking at a real assignment or a doc comment. BrassCoders uses the same structural approach across the stack — [ast-grep](https://ast-grep.github.io/) and [Semgrep](https://semgrep.dev/) cover the multi-language pattern layer, and the Babel scanner handles the JS/TS specifics.

## What's Covered, and the Honest Limit

BrassCoders's JS/TS scanner covers secrets and common security patterns; it does not do full interprocedural taint analysis for TypeScript, and that's a real boundary worth stating. The cross-file taint engine, Pyre/Pysa, is Python-only. A TypeScript bug whose tainted input crosses several files won't be traced the way the Python equivalent is.

For TypeScript-heavy services that need deep taint coverage today, the honest recommendation is to pair BrassCoders with a TypeScript analyzer built for it, like [CodeQL](https://codeql.github.com/) — BrassCoders for the unified secrets-and-patterns pass plus the AI-coder detectors, CodeQL for full TS dataflow. The reasoning behind why single-file context misses cross-file taint in any language is in the [cross-file bugs research](https://coppersun.dev/research/cross-file-bugs/).

## Run It

The JS/TS scanner runs automatically; you only need Node.js available for it:

```bash
pipx install brasscoders
brasscoders --offline scan
```

When the scan sees `.js`, `.ts`, `.jsx`, or `.tsx` files, the JavaScript/TypeScript layer activates and its findings appear in `.brass/` alongside the Python results, each tagged with the scanner that produced it. For the full set of detectors in the pass, see [what BrassCoders detects](https://coppersun.dev/what-brasscoders-detects/).