How I Built a Local, AI-Powered Code Security Scanner

The Problem I Kept Running Into

I've been working with local LLMs for a while, and one question kept coming up from people in regulated industries: "How do we use AI on our code if we can't send it to the cloud?"

Banks can't send source code to Snyk. Hospitals can't upload patient-data-adjacent code to Checkmarx. Government teams run air-gapped networks where cloud tools simply don't exist.

The usual answer is "use an on-premise scanner" — but most of those are enterprise-priced, hard to set up, and still require a data pipeline to some central server.

So I built something simpler.

What CodeGuardian Does

It's a local code security scanner. You give it a file, it gives you back a list of security issues with line numbers.

Runs entirely on your machine. No API calls. No telemetry. No data leaves your network.

The Stack

Nothing exotic:

• Python 3.12 + FastAPI for the API layer
• Ollama + Qwen 2.5 7B (16K context) for the LLM
• Docker + Docker Compose for deployment
• MIT license

The interesting part isn't the stack — it's how the scanning works.

How It Actually Works

I tried pure LLM scanning first. It was slow, expensive, and hallucinated constantly. It would flag safe code as "potential SQL injection" and miss obvious eval() calls.

So I went hybrid:

1. AST analysis first. Python's ast module catches deterministic issues — eval(), exec(), hardcoded passwords — with zero false positives. No tokens spent.
2. LLM only for the ambiguous cases. SQL injection patterns, context-dependent flaws, logic issues that need semantic understanding.

Result: ~90% coverage, and the LLM only sees what actually needs reasoning.

A Real Test

I ran it against a file with intentionally planted vulnerabilities. Here's what it found:

[eval() function]        → CRITICAL
[SQL injection]          → CRITICAL
[Hardcoded password]     → HIGH
[Command injection]      → HIGH

4 vulnerabilities in 7 seconds.