SecureVibeCoded (svc): The AI-Powered Secret Scanner Developers Would Actually Pay For

Description and use

SecureVibeCoded (svc) is an offline pre‑commit secret scanner that augments Gitleaks with machine‑learning filtering and a Gemma semantic auditor, reducing false positives to 8 % and blocking real secrets before they reach GitHub.

Problem

Developers frequently push sensitive credentials to public repositories, incurring high breach costs and alert fatigue.

Outcome

svc reduces false positives from ~58% to ~8%, blocks leaked secrets before they reach GitHub, and offers instant remediation while keeping all source code local.

Workflow

• Install svc via pip: pip install git+https://github.com/yashselokar2025/Hacktoberfest-CommitShield.git svc install
• Configure pre‑commit hook in the repository
• Stage changes and run git commit; svc scans staged diff
• If a secret is detected, svc uses logistic regression to score the match
• For borderline cases, svc invokes Google Gemma via Ollama to audit context
• If Gemma confirms a real secret, commit is blocked and remediation is suggested
• If the secret is a false positive, commit proceeds and the finding is logged in a local SQLite baseline

Evidence

SecureVibeCoded (svc) is an intelligent, change-aware secret scanner that sits on top of Gitleaks as a pre-commit hook.

Source

This model achieves F1 = 0.950, reducing false positives from the raw Gitleaks baseline of ~58% down to ~8%.

Source

Gemma runs 100% offline via Ollama — your proprietary source code never leaves your machine.

Source