Free+ · local scanner signal
Provenance tells you where AI-authored code concentrates risk.
Verglos does not treat AI-authorship as a vulnerability by itself. It annotates findings and reports with provenance signals so teams can see whether exploitable bugs cluster in agent-authored code, mixed-authorship code, or human-written code.
Git trailers
Co-Authored-By and similar commit metadata that can indicate AI-assisted authorship.
Commit shape
Fast, large, multi-file changes that match common agent-output patterns.
Code shape
Uniform docstrings, sparse TODOs, and repeated structure that can cluster AI-authored files.
Agent artifacts
.cursor/, .claude/, CLAUDE.md, and similar files that show an agent-driven workflow.
How it is measured
The scanner aggregates per-file signals into a repo-level `aiAuthoredPercent`. Provenance analysis is capped at 300 files by default for speed. Raise the cap with `VERGLOS_PROVENANCE_FILE_CAP=<n>` or skip the pass with `verglos scan --no-provenance` when a fast scan matters more than authorship context.
Why it matters
AI-generated code can repeat risky defaults quickly: weak tokens, permissive CORS, missing ownership checks, unpinned packages, and copied secrets. Provenance helps reviewers prioritize where that repeatability intersects with scanner findings.
Interaction with hunt
When a supported Hunt verdict is available, findings in AI-authored files can be flagged as AI-shipped exploitable. That is the highest-signal category: authored by the agent workflow and supported by bounded local evidence instead of only inferred by static analysis. It is not a general exploitability claim or an independent security review.