SecureVibeCoded (svc): The AI-Powered Secret Scanner Developers Would Actually Pay For

说明与用途

SecureVibeCoded (svc) 是一个离线预提交秘密扫描器，使用机器学习过滤和 Gemma 语义审计器增强 Gitleaks，将误报率降低至 8%，并在秘密发布前阻止真实密钥。

问题

Developers frequently push sensitive credentials to public repositories, incurring high breach costs and alert fatigue.

结果

svc reduces false positives from ~58% to ~8%, blocks leaked secrets before they reach GitHub, and offers instant remediation while keeping all source code local.

工作流

• Install svc via pip: pip install git+https://github.com/yashselokar2025/Hacktoberfest-CommitShield.git svc install
• Configure pre‑commit hook in the repository
• Stage changes and run git commit; svc scans staged diff
• If a secret is detected, svc uses logistic regression to score the match
• For borderline cases, svc invokes Google Gemma via Ollama to audit context
• If Gemma confirms a real secret, commit is blocked and remediation is suggested
• If the secret is a false positive, commit proceeds and the finding is logged in a local SQLite baseline

证据

SecureVibeCoded (svc) is an intelligent, change-aware secret scanner that sits on top of Gitleaks as a pre-commit hook.

来源

This model achieves F1 = 0.950, reducing false positives from the raw Gitleaks baseline of ~58% down to ~8%.

来源

Gemma runs 100% offline via Ollama — your proprietary source code never leaves your machine.

来源