DEV Community: John Marin Babu

CodeBoo: Exorcising Your Codebase’s Hidden TODOs and Haunted Bugs

John Marin Babu — Sun, 01 Nov 2026 06:57:46 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine

What I Built

We’ve all left a line like // TODO: fix memory leak before launch in a file, closed the editor, and promptly forgotten it ever existed. Over time, repos turn into digital haunted houses—populated by lingering code debt, unindexed security hazards, and ghost functions abandoned three years ago.

CodeBoo is a lightweight, local tool that brings those code ghosts out into the open.

Point CodeBoo at any local directory on your machine or paste a public GitHub repository link. It scans the files for six distinct types of technical debt and security issues:

Leaked Secrets: Hard-coded passwords, API tokens, and private keys.
Risky Code: Insecure string evaluations, unsafe data loading, or unsanitized commands.
Weak Spots: Disabled SSL checks, active debug modes, or outdated hashing.
Possible Leaks: Unclosed files, dangling timers, or unreleased memory resources.
Quiet Failures: Empty catch blocks or silent except: statements that hide errors.
Forgotten Promises: TODO, FIXME, HACK, XXX, and BUG comments left behind.

Instead of dumping a dry terminal log, CodeBoo ranks findings into five visual urgency tiers: Wisp, Little ghost, Haunting, Specter, and Phantom—ranging from "tidy up whenever" to "fix today."

It turns technical debt triage into something clear, visual, and oddly charming.

Demo

Code

marinn-3011 / codeboo-identify-ghost-todos

CodeBoo: A tool that hunts for hidden TODOs in your codebase and visualizes them.

CodeBoo

Paste a public GitHub link or a folder on your computer. CodeBoo looks through the code for forgotten promises, risky spots and quiet failures, ranks them by urgency, and shows each one as a ghost. Small problems are cute little wisps. Serious ones are tall, glowing and a bit scary. A model running on your own machine explains the most urgent ones in everyday words.

Built for the DEV Hacktoberfest 2026 "Ghost in the Machine" challenge, with open-weight models doing the explaining.

What it finds

Ghost	What it means	Examples
Leaked secret	Keys or passwords typed into the code	Private keys, cloud and GitHub tokens, hard-coded passwords
Risky code	Code that could be tricked into doing something harmful	Running text as code, shell commands, unsafe loading of saved data, database questions built by gluing text
Weak spot	Settings that make an app easier to attack	Switched-off certificate checks, old

…

View on GitHub

How I Built It

CodeBoo was built to run entirely on a mid-range developer machine (designed to consume under 5 GB of system memory, leaving plenty of room within an 8 GB free RAM budget).

CodeBoo was built with zero third-party Python dependencies—there is literally nothing to pip install. The entire application runs using Python's standard library and a local open-weight AI model.

Zero-Dependency Core (hunt.py): The server and scanner are contained in a single Python file listening on 127.0.0.1:8766. It directly extracts GitHub repository ZIP archives into temporary directories (or reads local folders in place) and runs about 20 pattern-matching rules across up to 800 files.
Local AI via Ollama: Explanations are generated by Gemma 4 (gemma4:e4b), running locally through Ollama (with support for qwen3.5:4b via environment variables).
AI Guardrails & Secret Masking: The 24 most urgent ghosts are sent to Gemma in small batches for plain-English explanations and recommended fixes. Before any code snippet is sent to the model, all detected secret values are strictly redacted.
Constrained Influence: To prevent LLM hallucinations from hiding genuine security hazards, the model can only adjust a ghost's urgency by a small margin. If the model deems a finding harmless, it lowers the urgency slightly; otherwise, the deterministic rule remains authoritative.
Severity Ranking Engine: The LLM evaluates every discovered issue and assigns it an urgency rating (1 to 5), an issue category (Security, Leak, Refactor, TODO), a plain-English explanation (keeping jargon accessible), and a recommended fix.
Visual UI: A single-page web dashboard using CSS animations to display issue "cards" inside animated ghost sprites whose expressions and dark glow scale with the severity of the bug.
Graceful Fallback: If Ollama is not running, CodeBoo continues to function entirely offline using built-in static explanations for every issue found.

Limitations

Repository Size: Extremely large repos (thousands of files) must be scanned module-by-module to keep context window usage within RAM bounds.
Static Analysis Edge Cases: While local open-weight models excel at finding logic flaws and written TODOs, full runtime memory profiling still requires dedicated profilers.
Scope Caps: Scans are capped at 800 files (up to 300 KB each), showing up to 60 total ghosts and generating AI explanations for the top 24 to keep local runs fast.

Why Does Open Innovation Matter?

Codebase Confidentiality: Scanning code for security bugs or unhandled edge cases using a closed cloud API means sending your proprietary context to external servers. Local open-weight models guarantee your code never leaves your device.
Unrestricted Code Scans: You can run CodeBoo against massive personal repos or multiple commits without worrying about token limits, rate caps, or monthly bills.
Customizable Parsing: Because the inference runner and prompts are completely transparent, developers can swap out models or fine-tune prompt constraints for their specific language stack.

Prize Categories

Best Use of Gemma (Powered by local gemma4:e4b inference via Ollama for plain-English bug explanations)

Recalling dreams every morning felt like holding water in my hands; so I built Nightloom.

John Marin Babu — Sun, 25 Oct 2026 20:41:41 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

We’ve all been there: you wake up from a vivid, wild dream, scribble down a few hazy keywords like "floating clock, neon fog, library with no doors", and by the time you pour your morning coffee, the rest of the memory has completely evaporated.

Nightloom turns those fading scraps into something lasting.

You type in your raw, half-remembered fragments—in any order, with zero formatting—and Nightloom weaves them into a structured short story and paints a watercolor scene from it.

Everything runs 100% locally on your computer, so your beloved dreams stay with you. Because memory efficiency was a core design constraint, it works seamlessly even on modest machines with just 4–6 GB of free RAM.

To match the "Slow and Steady" theme, the page itself embraces a soothing night-sky aesthetic complete with drifting lanterns, an arched golden loom, and thread-weaving animations.

Demo

(Real-time footage of my 4GB RAM laptop fighting for its life so you don't have to.)

Code

marinn-3011 / nightloom-dream-logger

NightLoom: A Dream-Logging application that visualizes your dreams from fragments (HF26)

Nightloom

A local-first dream logger. Type scattered fragments of a dream, in any order, and Gemma weaves them into one dreamlike story. Optionally, a small open image model paints one scene from it in a watercolor style.

Everything runs on your machine. The page talks to a small Python server on 127.0.0.1, which talks to Ollama on localhost and, for images, to a local stable-diffusion.cpp program. Dreams are saved to dreams.jsonl in this folder.

Run it (text only)

Install Ollama. Gemma 4 needs a recent version (0.22 or newer).
Pull a model: ollama pull gemma4. On a low-memory laptop, try a smaller tag such as gemma4:e2b and start the app with DREAM_MODEL=gemma4:e2b python3 dream.py.
Start the app: python3 dream.py
Open http://127.0.0.1:8765

No pip install needed. The page shows a status line, so you'll see if Ollama or the model is missing.

Add images (optional)

Images use…

View on GitHub

How I Built It

Nightloom is powered entirely by open-source components, orchestrated by a single zero-dependency Python server (dream.py) and a lightweight single-file frontend (index.html).

Story Generation: Gemma 4 (running locally via Ollama, using the light gemma4:e2b tag). The prompt strictly guides Gemma to retain every user fragment, avoid interpreting psychological meanings, and leave ambiguous parts blurry rather than inventing major plot points. Still, the model may get creative in ways to tie up the fragments into a cohesive story.
Image Generation Engine: stable-diffusion.cpp, a lightweight C/C++ runner that runs Stable Diffusion on laptop CPUs without heavy framework overhead.
Speed & Style: A standard Stable Diffusion 1.5 checkpoint enhanced with LCM-LoRA (latent-consistency/lcm-lora-sdv1-5) to reduce render times to ~4 steps, and fladdict's watercolor LoRA (trained on public-domain historical paintings) to give every painting a cohesive art style.
The Low-RAM Swap Trick: To run smoothly on devices with only 4–6 GB of free RAM, dream.py automatically unloads Gemma from RAM before running stable-diffusion.cpp, freeing up system resources for image rendering.

Honest Limitations

CPU Render Speeds: CPU painting takes a few moments on standard laptop processors.
SD 1.5 Detail: As a lightweight model, facial details and fine elements can be painterly and rough.
Minor Filler: While the prompt strictly restricts inventing new plotlines, the LLM will occasionally add brief connective phrasing to link fragments together.

Why Does Open Innovation Matter?

Absolute Privacy for Private Thoughts: Dreams are about as personal as text gets. Sending your half-conscious thoughts to a hosted cloud API feels invasive. Local inference guarantees your dreams stay on your device.

Zero Cost & No Rate Limits: You can weave and paint as many dreams as you want without worrying about API keys, usage limits, or monthly tokens.

Community Composability: Nightloom exists because independent creators shared their work—from stable-diffusion.cpp's lightweight engine to fladdict's public-domain watercolor LoRA. Closed models simply don't allow this level of modular stitching.

The Lazy Payoff

Dream journaling usually takes active effort right when you're least awake. Nightloom turns lazy inputs into a full creative artifact. You type three messy fragments while still half-asleep, hit one button, and get a rendered story and framed watercolor painting back. So the next time your divine muse brings you that flash of inspo, sleep in, and leave the heavy-lifting to Nightloom.

Prize Categories

Best Use of Gemma

Scribe: A Local Gemma 4 Tool That Turns Paper Piles into Digital Copies

John Marin Babu — Mon, 19 Oct 2026 06:57:36 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Scribe turns photos of paperwork into clean formatted JSON. You drop in receipts, invoices or business cards, and it reads them, pulls out the fields you care about, and files everything into tidy folders. And the best part - It all runs on your own computer using Gemma 4.

It is built for people who are drowning in paper: freelancers and small shop owners at tax time, bookkeepers retyping receipts, anyone with a pile of business cards from the last conference. Cloud OCR tools charge per page and need you to upload sensitive documents. Scribe doesn’t.

Demo

Code

marinn-3011 / scribe-image-to-json

Scribe: A tool to convert Photos of Receipts and Invoices into Sorted JSON with Gemma 4

Scribe

Turn photos of receipts, invoices and business cards into clean, sorted JSON. Runs locally with Gemma 4 through Ollama, so your documents never leave your machine.

Built for the Hacktoberfest 2026 Open-Source AI Challenge (Side Hustle).

Features

Batch scanning: drop in many images and get one combined JSON file.
Custom schemas: use a preset (receipt, invoice, business card), write your own name: type fields, or paste a full JSON Schema.
Auto-sort: Scribe detects each document's type and files it into folders, with the original image next to its JSON. Download everything as a .zip.
Auto mode: no schema needed, the model chooses the fields.
Exports: copy the result, or save it as JSON or CSV.
No guessing: fields the model can't see come back as null.

Requirements

Python 3.10+
Ollama
Enough memory for your chosen model (roughly 12 GB free for gemma4:e4b)

Setup

# 1.

…

View on GitHub

How I Built It

The model is Gemma 4, served locally through Ollama. I default to the small gemma4:e4b for speed, and the UI lets you switch to the 26B or 31B models when a document is tricky. Gemma 4 reads images directly, so there’s no separate OCR step. It also natively supports over 140 languages (with out-of-the-box fluency in 35+), enabling it to seamlessly process, understand, and translate documents featuring multiple languages simultaneously.

For each document, Scribe does three things: it asks Gemma 4 what kind of document it is, extracts the fields using the matching schema, then saves the original and the JSON into a folder for that type.

The part that made this work was Ollama’s structured outputs. You pass a JSON Schema in the request, and the model’s answer follows it:

payload = {
    "model": "gemma4:e4b",
    "format": schema,  # your JSON Schema
    "options": {"temperature": 0},
    "messages": [{"role": "user", "content": "Extract the data.", "images": [image_b64]}],
}

Why Does Open Innovation Matter?

Scribe handles receipts, invoices and contact details, so privacy is the whole point. Gemma 4’s weights are published under Apache 2.0, which means the model runs on the customer’s machine and their documents never leave it. Data Security and Privacy is hard to promise when it comes to closed APIs.

It also makes the economics work for a side hustle. There are no per-page fees and no rate limits, so scanning a thousand receipts costs a bit of electricity. As it processes files locally, It even works offline.

Prize Categories

Best Use of Gemma