An Autonomous AI Vulnerability Remediation Engine built for the Google Cloud & AI Hackathon!

Description and use

OneShield automatically eliminates security alert noise in banking, synthesizes fixes, and enforces zero-trust DevSecOps.

Problem

Enterprise banking security teams receive thousands of alerts daily, but over 70% are unreachable dead code, creating noise and inefficiency.

Outcome

OneShield reduced alert noise, automated fix synthesis, and enforced zero-trust DevSecOps gates, streamlining vulnerability remediation in a banking environment.

Workflow

• 1. Deploy Trivy Operator via Helm in GKE Autopilot for real-time container scanning.
• 2. Run concurrent SAST, DAST, and SCA analyses using Google Gemini 3.7 Flash and Antigravity SDK.
• 3. Apply 3-layer guardrails: prompt injection defense, confidence fail-safe, and AST/secret validation.
• 4. Synthesize fixes automatically and validate with AST syntax and secret leak checks.
• 5. Sign containers keylessly with Sigstore Cosign and enforce Kyverno admission policies.
• 6. Collect telemetry with OpenTelemetry SDK and LangSmith for quality tracking.

Evidence

In enterprise banking, security teams are flooded with thousands of security alerts daily, but over 70% represent unreachable dead code.

Source

We built OneShield to solve scanner noise and automate fix synthesis with zero-trust guardrails.

Source