Block the XML parser that reads your files.
When an XML parser resolves external entities, a crafted document reads /etc/passwd or hits an internal URL. AI enables it by copying a permissive parser config. SlopGrade blocks the unsafe parse in CI, before merge.
An XML parser with external entities enabled.
The parser is told to resolve entities, so a <!ENTITY> pointing at a file or URL is expanded. Disabling entity resolution (the secure default in most libs) fixes it — the gate blocks the config that turns it back on.
What the AI shipped
What leaves your runner
Path, line, class. The file content never leaves. Audit it with --print-payload.
Detect → adapt → verify. Nothing else leaves.
In your runner, on the diff
The open-source client walks the pull request and flags the pattern locally — intra-function dataflow, no code leaves the machine.
Server verdict + gate
The structural fingerprint is classified server-side. A hard hit blocks the check on a paid private repo; public repos are gated free; the paywall fails open.
Posted inline, fix verified locally
The finding is posted on its exact line. Where a fix exists it is generated AND verified in your runner — only offered once a re-scan proves the issue is gone.
Isn't XXE off by default now?
Modern parsers default to safe, but AI frequently copies old snippets that explicitly re-enable entities (noent: true, FEATURE_SECURE_PROCESSING off). The gate flags exactly those re-enabling configs.
Which parsers are covered?
Common XML libraries across JS/TS, Python, Java and .NET — the ones whose insecure configuration is a one-flag change.