GitHygiene: Does This Vulnerability Actually Matter in My Code?

Описание и применение

GitHygiene преобразует результаты сканирования уязвимостей в практические рекомендации, определяя, достигает ли код уязвимой части, какие репозитории затронуты и как исправить проблему.

Задача

Security scanners report many vulnerabilities, but developers cannot tell which ones affect their application, which are deep in the dependency tree, which are actually used, and which should be fixed first.

Результат

GitHygiene transforms raw vulnerability findings into actionable insights by determining code reachability, mapping affected repositories, and providing remediation steps, thereby reducing the noise from traditional scanners.

Рабочий процесс

• Connect to GitHub repositories
• Scan package.json, package-lock.json, requirements.txt to build dependency tree
• Check packages against OSV.dev and detect outdated/deprecated dependencies
• Gemma 4 reads advisory to identify vulnerable surface
• Static analysis searches repository for imports, symbols, call sites related to vulnerable surface
• Gemma 4 assesses reachability using advisory info and evidence
• Classify result into one of four outcomes
• Use Neo4j to model dependency relationships and trace blast radius
• Generate remediation recommendations and draft GitHub issue with evidence

Доказательства

GitHygiene connects to your GitHub repositories and builds a map of your dependencies, vulnerabilities and the code that actually uses them.

Источник

We split the AI workflow into separate stages. First: Gemma 4 reads the advisory and identifies the vulnerable surface…

Источник

The result is one of four outcomes: reachable, likely_reachable, not_evidenced, unused

Источник

We used Neo4j to model the dependency relationships…

Источник