AI Code Detection
Detect AI-generated code in your repositories and enforce quality policies through PR gates.
Overview
AI-assisted code generation ("vibe coding") is rapidly increasing in adoption. While it boosts productivity, it introduces unique risks: AI tools can generate code with subtle bugs, excessive complexity, poor error handling, security vulnerabilities, and even hallucinated dependencies.
Sectora's AI Code Detection analyzes git commit patterns and source code to estimate the percentage of AI-generated code in a repository. It produces a risk score (0-100) and generates specific, actionable improvement recommendations.
Detection Signals
The detector analyzes two categories of signals:
Commit Pattern Analysis
| Signal | What It Detects | Threshold |
|---|---|---|
| Commit Bursts | Commits within 2 minutes of each other — typical of AI-assisted coding sessions where code is generated, reviewed, and committed rapidly | >30% of commits |
| Large Commits | Commits with 300+ lines changed — AI tools often generate entire files or large code blocks at once | >5 commits |
| AI-Style Messages | Commit messages matching patterns like "Implement the user authentication...", "feat: ...", or containing Co-Authored-By: noreply@ | >40% of commits |
| High Average Lines | Average lines per commit exceeding 200 — suggests bulk code generation rather than incremental development | >200 lines/commit |
| Single Author | High percentage of commits from a single author — combined with other signals, suggests AI pair programming | Contextual |
Source Code Pattern Analysis
| Signal | What It Detects | Threshold |
|---|---|---|
| Boilerplate Comments | Comments like "This function handles...", "Helper method to...", "Initialize the..." that AI tools commonly generate | >20% of files |
| Excessive Comments | Files where >40% of lines are comments — AI tools tend to over-document with redundant explanations | >25% of files |
| Excessive Error Handling | Files where >15% of code is try/catch blocks — AI tools over-generate error handling patterns | >20% of files |
| Uniform Style | Files with unusually consistent indentation patterns (>80% matching) — human code naturally varies more | Contextual |
Scoring
The AI code percentage estimate uses a weighted combination of signals:
- Commit burst pattern — 25% weight
- Large commit pattern — 20% weight
- AI commit messages — 15% weight
- High avg lines/commit — 15% weight
- Boilerplate comments — 10% weight
- Excessive comments — 10% weight
- Excessive error handling — 5% weight
The risk score is then computed as: base_score = ai_pct * 0.7 + confidence_boost, where the confidence boost (up to 30 points) is derived from the number and confidence of individual signals.
AI Code Policy
You can configure automated enforcement of AI code quality standards through the AI Code Policy settings (Vibe Risk → AI Code Policy):
- Max AI Percentage — Set a threshold (default 70%) above which PRs are flagged
- Max AI Risk Score — Set a score threshold (default 80) above which PRs are flagged
- Action: Warn — Adds a comment to the PR and marks the GitHub check as "action required"
- Action: Block — Fails the GitHub check run, preventing the PR from being merged until AI code is reduced
- Notifications — Optionally send alerts when violations are detected
Improvement Recommendations
The detail view for each repository provides specific, actionable recommendations based on detected signals:
- Commit Bursts — Break large changes into smaller, reviewed commits with feature branches
- Large Commits — Limit commits to <200 lines; use incremental development
- Boilerplate Comments — Remove "This function..." comments; write comments only for non-obvious logic
- Excessive Error Handling — Simplify try/catch blocks; let errors propagate naturally
- General — Review all AI code before committing, run SAST+SCA scans, establish team conventions
Supported Languages
AI code detection analyzes source files in: Go, JavaScript, TypeScript (TSX/JSX), Python, Java, Ruby, PHP, Rust, C#, C/C++, Swift, Kotlin, Scala, Vue, and Svelte. Up to 200 files are sampled per repository for performance.
Integration with PR Gates
When AI Code Policy is enabled and a PR-triggered SCA scan completes, the scan results include AI code analysis. If thresholds are exceeded, the GitHub check run is updated with the appropriate conclusion (action_required or failure) and includes details about which signals were detected.