What I Built

We’ve all left a line like // TODO: fix memory leak before launch in a file, closed the editor, and promptly forgotten it ever existed. Over time, repos turn into digital haunted houses—populated by lingering code debt, unindexed security hazards, and ghost functions abandoned three years ago.

CodeBoo is a lightweight, local tool that brings those code ghosts out into the open.

Point CodeBoo at any local directory on your machine or paste a public GitHub repository link. It scans the files for six distinct types of technical debt and security issues:

Leaked Secrets: Hard-coded passwords, API tokens, and private keys.

Risky Code: Insecure string evaluations, unsafe data loading, or unsanitized commands.

Weak Spots: Disabled SSL checks, active debug modes, or outdated hashing.

Possible Leaks: Unclosed files, dangling timers, or unreleased memory resources.

Quiet Failures: Empty catch blocks or silent except: statements that hide errors.

Forgotten Promises: TODO, FIXME, HACK, XXX, and BUG comments left behind.

Instead of dumping a dry terminal log, CodeBoo ranks findings into five visual urgency tiers: Wisp, Little ghost, Haunting, Specter, and Phantom—ranging from "tidy up whenever" to "fix today."

It turns technical debt triage into something clear, visual, and oddly charming.

Code

marinn-3011 / codeboo-identify-ghost-todos

CodeBoo: A tool that hunts for hidden TODOs in your codebase and visualizes them.

CodeBoo

Paste a public GitHub link or a folder on your computer. CodeBoo looks through the code for forgotten promises, risky spots and quiet failures, ranks them by urgency, and shows each one as a ghost. Small problems are cute little wisps. Serious ones are tall, glowing and a bit scary. A model running on your own machine explains the most urgent ones in everyday words.

Built for the DEV Hacktoberfest 2026 "Ghost in the Machine" challenge, with open-weight models doing the explaining.

What it finds

Ghost	What it means	Examples
Leaked secret	Keys or passwords typed into the code	Private keys, cloud and GitHub tokens, hard-coded passwords
Risky code	Code that could be tricked into doing something harmful	Running text as code, shell commands, unsafe loading of saved data, database questions built by gluing text
Weak spot	Settings that make an app easier to attack	Switched-off certificate checks, old

…

View on GitHub

How I Built It

CodeBoo was built to run entirely on a mid-range developer machine (designed to consume under 5 GB of system memory, leaving plenty of room within an 8 GB free RAM budget).

CodeBoo was built with zero third-party Python dependencies—there is literally nothing to pip install. The entire application runs using Python's standard library and a local open-weight AI model.

Zero-Dependency Core (hunt.py): The server and scanner are contained in a single Python file listening on 127.0.0.1:8766. It directly extracts GitHub repository ZIP archives into temporary directories (or reads local folders in place) and runs about 20 pattern-matching rules across up to 800 files.

Local AI via Ollama: Explanations are generated by Gemma 4 (gemma4:e4b), running locally through Ollama (with support for qwen3.5:4b via environment variables).

AI Guardrails & Secret Masking: The 24 most urgent ghosts are sent to Gemma in small batches for plain-English explanations and recommended fixes. Before any code snippet is sent to the model, all detected secret values are strictly redacted.

Constrained Influence: To prevent LLM hallucinations from hiding genuine security hazards, the model can only adjust a ghost's urgency by a small margin. If the model deems a finding harmless, it lowers the urgency slightly; otherwise, the deterministic rule remains authoritative.

Severity Ranking Engine: The LLM evaluates every discovered issue and assigns it an urgency rating (1 to 5), an issue category (Security, Leak, Refactor, TODO), a plain-English explanation (keeping jargon accessible), and a recommended fix.

Visual UI: A single-page web dashboard using CSS animations to display issue "cards" inside animated ghost sprites whose expressions and dark glow scale with the severity of the bug.

Graceful Fallback: If Ollama is not running, CodeBoo continues to function entirely offline using built-in static explanations for every issue found.

Limitations

Repository Size: Extremely large repos (thousands of files) must be scanned module-by-module to keep context window usage within RAM bounds.

Static Analysis Edge Cases: While local open-weight models excel at finding logic flaws and written TODOs, full runtime memory profiling still requires dedicated profilers.

Scope Caps: Scans are capped at 800 files (up to 300 KB each), showing up to 60 total ghosts and generating AI explanations for the top 24 to keep local runs fast.

Why Does Open Innovation Matter?

Codebase Confidentiality: Scanning code for security bugs or unhandled edge cases using a closed cloud API means sending your proprietary context to external servers. Local open-weight models guarantee your code never leaves your device.

Unrestricted Code Scans: You can run CodeBoo against massive personal repos or multiple commits without worrying about token limits, rate caps, or monthly bills.

Customizable Parsing: Because the inference runner and prompts are completely transparent, developers can swap out models or fine-tune prompt constraints for their specific language stack.

DEV Community

CodeBoo: Exorcising Your Codebase’s Hidden TODOs and Haunted Bugs