Does BrassCoders Scan Node.js and TypeScript Code?

Yes. BrassCoders scans JavaScript and TypeScript files automatically in the same pass as Python. Two scanner layers run against your JS/TS code: BrassCoders’s dedicated JavaScript/TypeScript scanner, built on Babel’s AST parser, and Semgrep, which also runs rules against JS/TS files.

The Babel-based scanner operates on .js, .jsx, .ts, .tsx, .mjs, and .cjs files. Because it parses code into an abstract syntax tree rather than matching raw text, findings track the structure of your code rather than its whitespace or formatting. Five security patterns trigger findings:

• eval() calls (dangerous_eval): a primary code-injection vector
• innerHTML assignments (innerHTML_usage): the most common XSS source in browser-side JavaScript
• document.write() calls (document_write): a secondary DOM-based XSS path
• String literals matching common API key formats (potential_api_key)
• Hardcoded password strings (hardcoded_password)

Semgrep runs its own rule set against the same files in the same scan. The two layers are complementary: Semgrep covers patterns defined in its OSS ruleset; the Babel scanner adds AST-level analysis that survives identifier renames and code reformatting.

Where Bandit fits — and where it doesn’t: Bandit is Python-only. BrassCoders runs Bandit as one of its 12 scanners, but only against Python files. If you’re asking because you assumed Bandit covered your Node.js backend, it does not. That work goes to the Babel scanner and Semgrep.

The gap compared to Python coverage: The Python scanner set — Bandit with 50+ rules alongside Pylint, Pyre/Pysa, and six custom scanners — is broader than the JS/TS layer. There’s no JS/TS equivalent to Bandit’s rule depth or to Pyre’s interprocedural taint analysis. The Babel scanner and Semgrep catch the highest-signal JS/TS security patterns, but combined coverage is narrower than what BrassCoders provides for Python.

For mixed-language projects, that’s still a meaningful gain. A FastAPI backend with a Next.js frontend gets Python findings from the full scanner set and JS/TS findings from the Babel scanner and Semgrep — all in one .brass/ai_instructions.yaml file, one scan pass, no per-language toolchain stitching required.

To scan any project:

pip install brasscoders
brasscoders scan /path/to/your/project

BrassCoders detects file types automatically. JS/TS findings land in .brass/ai_instructions.yaml alongside Python ones, tagged by scanner name so your AI assistant can triage them in context.