SlothSec: Your Local AI Security Analyst That Finds and Fixes Vulnerabilities 🦥🔐

说明与用途

SlothSec 将开源安全扫描工具与通过 Ollama 的本地 Qwen3:4b 模型集成，提供统一的仪表盘，用于本地检测、分析和修复漏洞，消除对云服务的依赖。

问题

Developers and small teams spend excessive time juggling multiple security tools, manually interpreting findings, and crafting fixes, leading to time-consuming and error-prone workflows.

结果

SlothSec successfully integrates multiple open-source security scanners, provides AI-driven explanations and remediation, and operates entirely locally without cloud dependencies, as demonstrated by a working demo, passing tests, and real scan findings displayed in the dashboard.

工作流

• Register and manage local repositories
• Run Semgrep, OSV-Scanner, and Gitleaks scans
• Deduplicate findings via fingerprint matching
• AI analyst (Qwen3:4b) analyzes findings and produces explanations and remediation suggestions
• Generate unified diff patches
• Review and approve patches in the dashboard
• Apply patches and rescan to verify resolution
• Schedule recurring scans with cron
• Export reports as JSON or PDF
• Monitor execution and metrics via OpenTelemetry

证据

SlothSec brings multiple security tools together into one dashboard. It scans local repositories, identifies vulnerabilities, uses a locally running AI model to explain security findings, and helps developers generate and apply potential fixes.

来源

The project has passed its initial validation: Backend starts successfully. Frontend production build completes successfully. All 10 automated tests pass. Semgrep, OSV-Scanner, and Gitleaks are detected and available. Local Qwen3:4b inference is working through Ollama.

来源

SlothSec uses Qwen3:4b through Ollama for local AI-powered vulnerability analysis.

来源