How I Built a Local, AI-Powered Code Security Scanner

Описание и применение

Создан локальный сканер безопасности кода, использующий LLM и статический анализ, без передачи данных в облако.

Задача

Regulated industries cannot send source code to cloud-based security scanners, yet need local, privacy-preserving code analysis.

Результат

The scanner achieved ~90% coverage, detecting 4 vulnerabilities in a 7-second run on a test file, with no false positives from deterministic checks and minimal LLM usage.

Рабочий процесс

• 1. Install Docker and Docker Compose.
• 2. Pull the CodeGuardian image from the repository.
• 3. Run the container with Docker Compose to expose the FastAPI endpoint.
• 4. Send a source file to the local API endpoint via HTTP POST.
• 5. The scanner performs AST analysis to catch deterministic issues.
• 6. Ambiguous cases are forwarded to the local LLM (Ollama + Qwen 2.5 7B).
• 7. The API returns a list of detected vulnerabilities with severity and line numbers.

Доказательства

I ran it against a file with intentionally planted vulnerabilities. Here's what it found: [eval() function] → CRITICAL [SQL injection] → CRITICAL [Hardcoded password] → HIGH [Command injection] → HIGH 4 vulnerabilities in 7 seconds.

Источник