Weakness axis #6

Hallucinations

AI-fabricated API calls, non-existent libraries, made-up types. Caught at PR time.

Run on your repo →See pricing

What this axis covers

Modern codebases accumulate fabricated or impossible API surfaces — calls to library functions that were never written, types that look right but aren't real, imports from packages that resolve to typosquats. Securie's hallucinations specialist resolves every symbol against the actual installed packages + documented public surface.

Why now

Hallucinated package names create slopsquat surface — attackers register the fabricated package on npm/PyPI and the AI's suggestion becomes a supply-chain compromise on install. The CVE pipeline cannot catch this; the resolve-against-reality pass at PR time can.

Where it hides in your codebase

  • Imports from packages that don't exist (and may be registered by an attacker tomorrow)
  • Method calls on types whose signatures the AI invented
  • Type assertions that compile but are wrong at runtime
  • Configuration keys for options that don't exist (silent no-ops)
  • API endpoint paths that look canonical but never existed in the docs

How Securie handles it

Resolve-against-installed

Every import + every method call is resolved against the actual installed package tree (LSP-IR) at PR time. Calls to non-existent surfaces fail the gate.

Slopsquat detection (npm / PyPI / crates / Maven)

Securie's registry-watch pipeline flags packages registered after the AI's training cutoff that match patterns the AI is known to fabricate (typosquats, homoglyphs, name-confusion). Pairs with the supply-chain pipeline for 15-minute CVE-to-block.

Documentation cross-reference

For framework APIs (React, Next.js, Supabase, Stripe, etc.), Securie cross-references against the documented public surface. Hallucinated method names get flagged with the canonical alternative.

What this axis is NOT

Not a generic LSP server

LSPs catch type errors at edit time; Securie's hallucinations specialist runs at PR time across the full diff with package-installation context, then verifies in a sandbox.

Not a license / SCA scanner

Dependency-vulnerability scanning is part of axis #1 (security). Hallucinations are about non-existent or fabricated surfaces — a different shape.