Will It Vibe?Undocumented std::mem::transmute
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
std::mem::transmute reinterprets raw bits as an arbitrary type with no runtime checks; a missing `// SAFETY:` comment nearby means the invariant that makes this sound is undocumented.
Why it matters
std::mem::transmute reinterprets the raw bits of one type as another with zero runtime checks, so a size mismatch, an invalid bit pattern, or a violated alignment requirement is instant undefined behavior rather than a caught error. It is one of the most dangerous operations in the language specifically because it can silently compile and appear to work in testing while still being unsound. A missing safety comment means nobody documented which of those failure modes was actually ruled out.
How to fix it
Add a "// SAFETY:" comment directly above the call (or as the first line inside the unsafe block) stating why the source and destination types have the same size and validity requirements are met. Where possible, replace the transmute with a safe alternative: f32::from_bits/to_bits and equivalents for numeric reinterpretation, or the bytemuck/zerocopy crates for structured data, since both provide the same reinterpretation with compile-time or runtime safety checks.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo