GitHygiene: Does This Vulnerability Actually Matter in My Code?

说明与用途

GitHygiene 将漏洞扫描结果转化为可操作的洞察，评估代码是否触及漏洞、哪些仓库受影响以及如何修复。

问题

Security scanners report many vulnerabilities, but developers cannot tell which ones affect their application, which are deep in the dependency tree, which are actually used, and which should be fixed first.

结果

GitHygiene transforms raw vulnerability findings into actionable insights by determining code reachability, mapping affected repositories, and providing remediation steps, thereby reducing the noise from traditional scanners.

工作流

• Connect to GitHub repositories
• Scan package.json, package-lock.json, requirements.txt to build dependency tree
• Check packages against OSV.dev and detect outdated/deprecated dependencies
• Gemma 4 reads advisory to identify vulnerable surface
• Static analysis searches repository for imports, symbols, call sites related to vulnerable surface
• Gemma 4 assesses reachability using advisory info and evidence
• Classify result into one of four outcomes
• Use Neo4j to model dependency relationships and trace blast radius
• Generate remediation recommendations and draft GitHub issue with evidence

证据

GitHygiene connects to your GitHub repositories and builds a map of your dependencies, vulnerabilities and the code that actually uses them.

来源

We split the AI workflow into separate stages. First: Gemma 4 reads the advisory and identifies the vulnerable surface…

来源

The result is one of four outcomes: reachable, likely_reachable, not_evidenced, unused

来源

We used Neo4j to model the dependency relationships…

来源