**Please read the full text**
This is the new eternity and most of the analyzer bugs and other bugs have been fixed
But what is this program and what does it do? Is this program a reason why VS Code should not be used anymore?
Well, I have been working on a code editor for a long time that can detect and rank a lot of security and optimization problems and obsolete codes and show the structure of your codes in the outline section. In addition to the analyzer and… it has the ability to change the theme and color the codes and a lot of other things.
# Luau Code Analyzer
A built-in code analyzer designed specifically for Roblox Luau development. It scans your code directly inside the editor and identifies performance issues, deprecated APIs, potential security risks, and common coding problems.
## Performance and Best Practices
The analyzer checks for a wide range of performance and code-quality issues, including:
> * Detecting outdated `wait()` usage and recommending `task.wait()`
> * Detecting infinite loops that run without yielding
> * Understanding when a loop already yields through a function call
> * Detecting `repeat ... until false` loops that may run indefinitely
> * Detecting event connections that are never disconnected
> * Recommending proper connection cleanup with `:Disconnect()`
> * Recommending `game:GetService()` instead of direct service access
> * Detecting inefficient `Instance.new(...).Parent = ...` patterns
> * Checking newly created `Part` and `MeshPart` objects for explicit collision settings
> * Detecting heavy math operations inside loops
> * Detecting multiple `string.split()` calls on the same line
> * Detecting multiple `task.wait()` calls on the same line
> * Recommending `task.spawn()`, `task.delay()`, and `task.defer()` instead of their older alternatives
> * Detecting cases where `ipairs()` may be more appropriate than `pairs()`
> * Recommending safer error handling with `pcall()`
> * Checking animation code for potentially undefined `Animator` objects
> * Checking Promise usage for missing error handling with `:catch()`
> * Detecting global debounce variables that could cause conflicts between scripts
> * Checking UI access for potentially missing or nil objects
> * Checking `Humanoid.Touched` usage for potentially problematic patterns
## Deprecated Roblox API Detection
The analyzer detects a variety of deprecated and legacy Roblox APIs and suggests modern alternatives where appropriate.
Some of the APIs and patterns it checks include:
> * `BodyVelocity`
> * `BodyGyro`
> * `BodyPosition`
> * `BodyForce`
> * `BodyThrust`
> * `BodyAngularVelocity`
> * `HopperBin`
> * `:Remove()`
> * `:connect()`
> * `:disconnect()`
> * `Workspace:FindPartOnRay()`
> * `Workspace:FindPartOnRayWithIgnoreList()`
> * `Terrain:ClearCells()`
> * `FilterStringForBroadcastAsync()`
> * Legacy `Mouse.Button1Down`
> * Numeric Enum indexing
> * Invalid `Instance.new("DataModel")`
> * Incorrect API casing such as `game:Getservice()`
The analyzer doesn't just flag deprecated APIs; it also provides an explanation of what should be used instead.
## Security and Suspicious Code Detection
The analyzer also checks for code patterns that may indicate unsafe, suspicious, obfuscated, or exploit-related code.
It can detect:
> * `loadstring()`
> * `loadfile()`
> * `getfenv()` and `setfenv()`
> * `getgenv()`
> * `writefile()` and `readfile()`
> * `hookfunction()`
> * `debug.getupvalue()`
> * `debug.setupvalue()`
> * `debug.sethook()`
> * Potentially suspicious use of `bit32`
> * `HttpGet()` combined with `loadstring()`
> * `require()` combined with `HttpGet()`
> * Obfuscated `string.char()` usage feeding into `loadstring()` or `pcall()`
> * `__metatable` manipulation
> * Infinite loops created through `task.spawn()`
Security findings can have different severity levels, ranging from low-level warnings to critical issues.
## Context-Aware Analysis
The analyzer is not limited to simple keyword matching. It also examines the surrounding code to make better decisions.
It can analyze:
> * Code before and after the current line
> * Enclosing `do`, `then`, `function`, and `repeat` blocks
> * Function bodies
> * Functions that call other functions
> * Whether a loop yields directly
> * Whether a loop yields indirectly through another function
> * Whether a loop can exit using `break` or `return`
> * Multi-line strings and comments
> * Single-line comments and string literals
This allows the analyzer to reduce false positives and distinguish between genuinely problematic code and code that is already handling the situation correctly.
## Comment and String Awareness
The analyzer understands that code-like text inside comments and strings should not normally be treated as actual code.
It handles:
> * Single-line comments
> * String literals
> * Multi-line strings
> * Multi-line comments
Before analysis, these sections are masked while preserving line numbers, preventing keywords inside comments or strings from interfering with the analysis.
## Findings and Severity
Every detected issue includes:
* The exact line number
* A description of the problem
* The issue category
* The severity level
* The original source-code line
Findings are then sorted by severity so that the most important issues appear first.
The analyzer supports several severity levels:
**Critical, High, Medium, Low, and Info.**
## Reliable Analysis Engine
The analyzer is designed so that an error in one individual rule does not crash the entire analyzer.
download link: amindez24
The reason this tool is recognized as a virus by scanners is, according to the AI itself, not me:
This is a well-known and documented issue specific to exe files built with Nuitka/PyInstaller (and compiled Python programs in general), not something specific to the code in this project. I wrote the source myself and I know there's no malicious code in it (no keyloggers, no data leaks, nothing hidden) — these detections are almost certainly false positives. Here's why:
1. Most of these are heuristic/ML, not signature-based
Watch out for names like:
Microsoft: Trojan:Win32/Wacatac.B!ml ← That !ml stands for machine learning, not that it found a signature of a known virus
CrowdStrike: malicious_confidence_70% ← It says it's only 70% confident, not definitive
Symantec: ML.Attribute.HighConfidence ← Again ML
Elastic: Malicious (high Confidence) ← Again a statistical model, not a signature
These engines are not looking for an "exact signature of malicious code"; they are comparing the structural pattern of the file to thousands of other malicious files they have seen before.
2. Why do they see exactly this pattern as malicious?
Programs built with Nuitka (especially with --onefile) extract themselves to a temporary folder when they run and run from there. This is exactly the behavior of real malware (dropper/trojan) — an exe that opens itself and runs from temp. Since many real malware are created with exactly the same tools (PyInstaller/Nuitka), AVs have learned to see this “shape” as suspicious — even if the content is completely harmless.
3. The file is not signed
The exe does not have a code signing certificate. Unsigned files with no history/reputation (because the hash of this file is completely new and has not been seen anywhere before) are much easier to detect as suspicious.
This problem is so common that the Nuitka developers themselves have a GitHub full of issues about exactly this (Trojan:Win32/Wacatac.B!ml on a simple Hello World completely devoid of any suspicious code).
Solutions (if you want to do them):
Switch from --onefile to --standalone — instead of a single self-extracting exe, create a folder with several separate files. This eliminates the same suspicious "self-extracting" behavior and greatly reduces false positives (documented and tested by many other developers).
Report false positives — each of these companies (especially Microsoft) has an official form for reporting false positives; it usually takes a few hours to a few days to review and remove them.
Digital signature (code signing certificate) — the most definitive solution, but it is expensive (around $70-200 per year) and is usually recommended for larger projects to be worth it.
Do you want me to change the build script to --standalone (instead of --onefile)? It's the easiest and freest way that really helps.
