SlothSec: Your Local AI Security Analyst That Finds and Fixes Vulnerabilities 🦥🔐

Description and use

SlothSec integrates open-source security scanners with a local Qwen3:4b model via Ollama to provide a unified dashboard for detecting, analyzing, and remediating vulnerabilities locally, eliminating cloud dependencies.

Problem

Developers and small teams spend excessive time juggling multiple security tools, manually interpreting findings, and crafting fixes, leading to time-consuming and error-prone workflows.

Outcome

SlothSec successfully integrates multiple open-source security scanners, provides AI-driven explanations and remediation, and operates entirely locally without cloud dependencies, as demonstrated by a working demo, passing tests, and real scan findings displayed in the dashboard.

Workflow

• Register and manage local repositories
• Run Semgrep, OSV-Scanner, and Gitleaks scans
• Deduplicate findings via fingerprint matching
• AI analyst (Qwen3:4b) analyzes findings and produces explanations and remediation suggestions
• Generate unified diff patches
• Review and approve patches in the dashboard
• Apply patches and rescan to verify resolution
• Schedule recurring scans with cron
• Export reports as JSON or PDF
• Monitor execution and metrics via OpenTelemetry

Evidence

SlothSec brings multiple security tools together into one dashboard. It scans local repositories, identifies vulnerabilities, uses a locally running AI model to explain security findings, and helps developers generate and apply potential fixes.

Source

The project has passed its initial validation: Backend starts successfully. Frontend production build completes successfully. All 10 automated tests pass. Semgrep, OSV-Scanner, and Gitleaks are detected and available. Local Qwen3:4b inference is working through Ollama.

Source

SlothSec uses Qwen3:4b through Ollama for local AI-powered vulnerability analysis.

Source