Scorecard
AI Code Risk Scorecard
Engineering lead answers security, architecture, compliance, and quality questions about Copilot, Cursor, or Claude Code. Scored snapshot — no repo upload.
Launch the scorecardInsights · Resources
Free tools for AI-assisted delivery — questionnaires, not repo uploads.
Score Copilot, Cursor, and Claude Code risk. Draft a one-page policy. Outline a Maxiom-style engagement. Map HIPAA minimum necessary. Client code stays in your environment.
Four tools
Launch a landing, then the app
Each tool has its own indexable page — problem, who it is for, what you get, FAQ — then a work-email gate and the questionnaire. Nothing here asks you to paste production source.
Policy
AI coding policy generator
Short questionnaire: allowed languages, secrets, PR review, PHI, no production data in prompts. One-page Markdown for Confluence.
Launch the generatorScoping
Engagement scope builder
Describe the problem, stack, regulatory context, and access constraints. Get the outline Maxiom uses: deliverables, NDA, read-only, named engineer.
Launch the builderHealthcare
HIPAA minimum-necessary mapper
Name a feature and the data it touches. Flag what must stay out of logs, prompts, analytics, and vendor subprocessors. One-pager — not an EHR.
Launch the mapperFree resource
AI Code Risk Checklist
The same security, architecture, compliance, and quality list as the scorecard — as a PDF for teams who want a printable pass before they score it.
Security
- Injection vulnerabilities in AI-generated query construction
- Authentication and authorization logic gaps
- Hardcoded or improperly handled secrets
- Insecure dependencies introduced without review
- Prompt injection exposure in LLM-integrated features
Architecture
- Unintended coupling between modules
- Data model assumptions conflicting with existing schema
- Performance anti-patterns (N+1 queries, unbounded pagination)
- Missing error handling and edge case coverage
Compliance
- PHI handling that does not meet minimum necessary standards
- Audit logging gaps for covered transactions
- Data residency and encryption-at-rest assumptions
- Third-party integrations without compliant data agreements
Code quality
- Test coverage on security-critical paths
- Dead code and duplicate logic from AI regeneration
- Documentation accuracy vs. actual behavior
Frequently asked questions
What is on the Maxiom Resources hub?
Four free, signup-gated tools — the AI Code Risk Scorecard, AI coding policy generator, engagement scope builder, and HIPAA minimum-necessary mapper — plus the original AI Code Risk Checklist PDF. Each tool has its own landing page.
Do I have to upload a repository?
No. Every tool is a questionnaire or generator that runs in the browser. Client code stays in your environment. We will not ask you to paste production source.
Why a work-email gate?
Same pattern as the checklist PDF. Enter work details once per browser session to use or export a tool. Submissions go to HubSpot — the same portal already used on this site. No second CRM.
Is the scorecard the same as an AI code audit?
No. The scorecard is a self-serve snapshot. An AI code audit is a named senior engineer, read-only access after NDA, and written findings in 5–10 business days.
Can I still download the checklist PDF?
Yes. The checklist remains on this page. The scorecard is the interactive version of the same security, architecture, compliance, and quality list.
Is the HIPAA mapper legal advice?
No. It is a feature-level mapping aid, said once and quietly on that page. It is not an EHR. Dedicated HealthTech work is Maxiom Labs.
Will you email the generated policy or scope?
The gate captures work email. Copy and print (save as PDF) work immediately in the browser. Forwarding a generated file via HubSpot is a workflow Antonio can attach to the existing form — the tools do not invent a mail server.
Who are these tools for?
Engineering, security, and healthcare product leads who need a one-pager tonight — not a slide about 500 projects. Senior judgment, named next step, no hype stats.
How do these relate to Copilot and Cursor?
The scorecard and policy generator are built for teams shipping with Copilot, Cursor, or Claude Code. The paid, tool-led landing is Copilot & Cursor code audit.
Where should I start if I am not sure?
If AI-assisted code is the worry, start with the scorecard. If you lack written rules, read how to write an AI coding policy engineers will follow and generate a one-pager. If you are booking Maxiom, use the scope builder. If the feature might see PHI, use the mapper. AI coaching and wearable products that may have left wellness: AI health and fitness app development.