SlothSec: Your Local AI Security Analyst That Finds and Fixes Vulnerabilities 🦥🔐

Описание и применение

SlothSec объединяет открытые инструменты сканирования безопасности и локальную модель Qwen3:4b через Ollama, предоставляя единый интерфейс для обнаружения, анализа и исправления уязвимостей без обращения к облачным сервисам.

Задача

Developers and small teams spend excessive time juggling multiple security tools, manually interpreting findings, and crafting fixes, leading to time-consuming and error-prone workflows.

Результат

SlothSec successfully integrates multiple open-source security scanners, provides AI-driven explanations and remediation, and operates entirely locally without cloud dependencies, as demonstrated by a working demo, passing tests, and real scan findings displayed in the dashboard.

Рабочий процесс

• Register and manage local repositories
• Run Semgrep, OSV-Scanner, and Gitleaks scans
• Deduplicate findings via fingerprint matching
• AI analyst (Qwen3:4b) analyzes findings and produces explanations and remediation suggestions
• Generate unified diff patches
• Review and approve patches in the dashboard
• Apply patches and rescan to verify resolution
• Schedule recurring scans with cron
• Export reports as JSON or PDF
• Monitor execution and metrics via OpenTelemetry

Доказательства

SlothSec brings multiple security tools together into one dashboard. It scans local repositories, identifies vulnerabilities, uses a locally running AI model to explain security findings, and helps developers generate and apply potential fixes.

Источник

The project has passed its initial validation: Backend starts successfully. Frontend production build completes successfully. All 10 automated tests pass. Semgrep, OSV-Scanner, and Gitleaks are detected and available. Local Qwen3:4b inference is working through Ollama.

Источник

SlothSec uses Qwen3:4b through Ollama for local AI-powered vulnerability analysis.

Источник