Block the XML parser that reads your files.
When an XML parser resolves external entities, a crafted document reads /etc/passwd or hits an internal URL. AI enables it by copying a permissive parser config. SlopGrade blocks the unsafe parse in CI, before merge.
An XML parser with external entities enabled.
The parser is told to resolve entities, so a <!ENTITY> pointing at a file or URL is expanded. Disabling entity resolution (the secure default in most libs) fixes it — the gate blocks the config that turns it back on.
What the AI shipped
What leaves your runner
Path, line, class. On a private repo the file content stays on the runner by default; the deep scan (heisen-slop) is a paid opt-in. Audit it with --print-payload.
Detect → adapt → verify. By default, nothing else leaves.
In your runner, on the diff
The open-source client walks the pull request and flags the pattern locally — intra-function dataflow. By default, no code leaves the machine.
Server verdict + gate
The structural fingerprint is classified server-side. A hard hit blocks the check on a paid private repo; public repos are gated free; the paywall fails open.
Posted inline, re-checked on push
The finding is posted on its exact line. For the few classes with a safe deterministic rewrite (TLS verification off, debug on, yaml.load…), a fix is generated AND verified in your runner; otherwise you fix it and the next push re-checks.
Isn't XXE off by default now?
Modern parsers default to safe, but AI frequently copies old snippets that explicitly re-enable entities (noent: true, FEATURE_SECURE_PROCESSING off). The gate flags exactly those re-enabling configs.
Which parsers are covered?
Common XML libraries across JS/TS, Python, Java and .NET — the ones whose insecure configuration is a one-flag change.