Free+ · local scanner signal

Provenance tells you where AI-authored code concentrates risk.

Verglos does not treat AI-authorship as a vulnerability by itself. It annotates findings and reports with provenance signals so teams can see whether exploitable bugs cluster in agent-authored code, mixed-authorship code, or human-written code.

Git trailers

Co-Authored-By and similar commit metadata that can indicate AI-assisted authorship.

Commit shape

Fast, large, multi-file changes that match common agent-output patterns.

Code shape

Uniform docstrings, sparse TODOs, and repeated structure that can cluster AI-authored files.

Agent artifacts

.cursor/, .claude/, CLAUDE.md, and similar files that show an agent-driven workflow.

How it is measured

The scanner aggregates per-file signals into a repo-level `aiAuthoredPercent`. Provenance analysis is capped at 300 files by default for speed. Raise the cap with `VERGLOS_PROVENANCE_FILE_CAP=<n>` or skip the pass with `verglos scan --no-provenance` when a fast scan matters more than authorship context.

Why it matters

AI-generated code can repeat risky defaults quickly: weak tokens, permissive CORS, missing ownership checks, unpinned packages, and copied secrets. Provenance helps reviewers prioritize where that repeatability intersects with scanner findings.

Interaction with hunt

When beta hunt verification is live, verified findings in AI-authored files can be flagged as AI-shipped exploitable. That is the highest-signal category: authored by the agent workflow and proved locally instead of only inferred by static analysis.