DEV Community: SAYUJ SUR

SlothSec: Your Local AI Security Analyst That Finds and Fixes Vulnerabilities 🦥🔐

SAYUJ SUR — Wed, 21 Oct 2026 06:41:51 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

Security vulnerabilities are easy to introduce and surprisingly easy to overlook.

Developers often have to switch between multiple security tools, manually interpret hundreds of findings, understand the root causes, and figure out how to fix them. For individual developers and small teams, maintaining this workflow can become time-consuming.

That's why I built SlothSec — a local-first, AI-powered application security analysis and remediation platform.

SlothSec brings multiple security tools together into one dashboard. It scans local repositories, identifies vulnerabilities, uses a locally running AI model to explain security findings, and helps developers generate and apply potential fixes.

The goal is simple: make security analysis less complicated and help developers spend less time investigating repetitive findings.

What can SlothSec do?

Repository Management: Register and manage local repositories with path validation and security checks.
Multi-Scanner Engine: Run Semgrep for Static Application Security Testing (SAST), OSV-Scanner for dependency vulnerabilities (SCA), and Gitleaks for exposed secrets.
Finding Deduplication: Identify duplicate findings across repeated scans using fingerprint-based matching.
AI Security Analyst: Use a locally hosted Qwen3 model through Ollama to analyze vulnerabilities, explain root causes, assess potential exploitability, and recommend remediation steps.
AI-Powered Remediation: Generate suggested code patches, review unified diffs, approve changes, and verify fixes through rescanning.
Automated Security Scans: Schedule recurring repository scans using cron-based automation.
Security Reports: Export findings and analysis as JSON or PDF reports.
Observability: Monitor scan execution, application metrics, and OpenTelemetry traces.

The important part is that SlothSec doesn't just tell developers that something is wrong. It helps them understand why it matters and what they can do about it.

Demo

Local demonstration: SlothSec currently runs locally.

Frontend Dashboard: http://localhost:5173
Backend API: http://127.0.0.1:8000
API Documentation: http://127.0.0.1:8000/docs
Local AI Engine: Ollama

The project has passed its initial validation:

Backend starts successfully.
Frontend production build completes successfully.
All 10 automated tests pass.
Semgrep, OSV-Scanner, and Gitleaks are detected and available.
Local Qwen3:4b inference is working through Ollama.
The dashboard successfully retrieves real scan findings.

Screenshots:

Code

GitHub Repository: https://github.com/sayuj5/SlothSec.git

The project is organized into two main parts:

backend/ — FastAPI backend, database models, security scanners, AI analysis, remediation engine, reporting, scheduling, and observability.
frontend/ — React and TypeScript dashboard with repository management, scan monitoring, vulnerability analysis, remediation workflows, and reports.

The repository also includes automated tests, configuration examples, and development scripts.

How I Built It

I wanted SlothSec to be more than another AI wrapper around a security scanner. The idea was to create a complete security workflow where deterministic security tools identify issues and an AI model helps developers understand and address them.

Technology Stack

Component	Technology
Backend	Python, FastAPI
Frontend	React, TypeScript, Vite
Database	SQLite, SQLAlchemy
AI Model	Qwen3:4b
Local Inference	Ollama
SAST	Semgrep
Dependency Scanning	OSV-Scanner
Secret Detection	Gitleaks
Scheduling	APScheduler
Observability	OpenTelemetry
PDF Reports	ReportLab

The AI Pipeline

SlothSec uses Qwen3:4b through Ollama for local AI-powered vulnerability analysis.

The workflow is designed around three main stages:

Detection: Security scanners identify vulnerabilities, insecure code patterns, dependency risks, and exposed secrets.
Analysis: The AI analyst receives structured finding information and generates an explanation containing an executive summary, root cause, exploitability assessment, and remediation recommendations.
Remediation: The platform generates a proposed unified diff that developers can review before approving and applying it. A subsequent scan helps verify whether the issue has been resolved.

The AI is an assistant rather than the source of truth. Security findings originate from dedicated scanning tools, while the LLM helps interpret those findings and propose fixes.

Why Local AI?

One of my main design decisions was to avoid depending on cloud-based AI APIs.

Using Ollama and Qwen3:4b allows SlothSec to perform AI analysis locally. This helps keep repository information and source code on the developer's machine rather than sending it to an external AI provider.

It also means there are no recurring AI API costs for the local inference workflow.

The project is designed to work without cloud storage or mandatory external AI services.

Why Does Open Innovation Matter?

Open innovation was an important part of building SlothSec.

Security tooling should be accessible to developers regardless of their budget or access to commercial platforms.

Here are a few things open-source technology made possible:

1. No dependence on a single security vendor

Semgrep, OSV-Scanner, and Gitleaks each specialize in different areas of application security. Combining them provides a broader analysis workflow without relying on one proprietary scanner.

2. AI without mandatory cloud APIs

Qwen3 is available as an open-weight model, and Ollama makes local inference accessible. Developers can experiment with AI-assisted security analysis without requiring a paid hosted AI API.

3. Transparency and customization

The scanning workflow, AI prompts, remediation logic, and application architecture can be inspected and modified. Developers can adapt the platform to their own repositories and security requirements.

4. Accessible security automation

By combining open-source scanners, a local database, and automated scheduling, SlothSec makes several security workflows accessible without expensive enterprise infrastructure.

I believe open innovation makes security tools more approachable, transparent, and adaptable.

The Lazy Payoff

The idea behind SlothSec is to make developers a little lazier about repetitive security work, but more proactive about fixing vulnerabilities.

Instead of manually running different scanners, switching between their reports, researching every finding, and writing fixes from scratch, developers can manage the workflow from one place.

SlothSec brings detection, analysis, remediation, verification, and reporting together.

The initial implementation is operational, with 10 automated tests passing and real scanner findings successfully appearing in the dashboard.

There is still room to improve the AI's remediation accuracy and expand scanner coverage, but the foundation is ready for further development.

Less manual investigation. More time building. Better security habits.

Prize Categories

Hacktoberfest Open-Source AI Challenge — Week 3: Slow and Steady

SlothSec uses the open-weight Qwen3:4b model through local Ollama inference to automate security analysis and remediation without relying on paid cloud AI services.

Built with open-source security tools, local AI, and a simple philosophy: security should be part of the development workflow, not an afterthought.

🦥 SlothSec — Slow down. Scan deeper. Ship safer.

I Built ScopePilot: An AI-Powered Proposal Generator Using Gemma 3 That Runs Locally

SAYUJ SUR — Sun, 18 Oct 2026 14:41:47 +0000

Freelancing isn't just about doing the actual work. Before a project even begins, freelancers often spend hours understanding client requirements, defining deliverables, estimating costs, planning milestones, and writing professional proposals.

And the problem? A client brief is rarely perfect.

Sometimes it's just a few sentences in an email. Sometimes it's a long document with unclear requirements. Turning that into a structured, professional proposal takes time that freelancers could spend doing paid work.

I wanted to build something to make that process easier.

Meet ScopePilot — a local-first AI-powered proposal and project-scoping assistant.

What I Built

ScopePilot transforms unstructured client briefs into structured, editable project proposals.

It's designed primarily for:

Freelancers who regularly prepare project proposals.

Independent developers and designers.

Small agencies and consultants.

People starting their freelancing journey who need help defining project scope and pricing.

Give ScopePilot a client brief, and it helps generate:

- Project Analysis:
Understands the client's requirements and objectives.

- Executive Summary:
Creates a professional project overview.

- Scope & Deliverables:
Breaks the project into clear deliverables and exclusions.

Technology Recommendations: ** Suggests an appropriate technology stack.

- Milestones & Timeline:
Organizes the project into manageable phases.

- Pricing Breakdown:
Provides indicative line-item estimates with deterministic calculations.

- Risks & Assumptions:
Identifies potential challenges and assumptions.

- Clarification Questions:
Highlights information that should be confirmed with the client.

The generated proposal can be edited, selectively regenerated, saved locally, and exported as PDF or Markdown.

The goal isn't to replace a freelancer's judgment. It's to reduce the repetitive work involved in preparing a proposal while keeping the freelancer in control.

Demo

Try the public interactive demo:

https://scopepilot-dccw64jmecdaxnjleyttdb.streamlit.app/

The public demo uses bundled sample proposals so visitors can explore the interface, edit sample content, and test exports without installing anything.

Want to experience the actual AI generation?

Run ScopePilot locally using Ollama and Gemma 3 1B. The local edition supports real AI-powered proposal generation without sending client briefs to an external LLM API.

Code

GitHub Repository: https://github.com/sayuj5/ScopePilot

The project is open source. You can explore the implementation, run it locally, and contribute.

How I Built It

The central idea behind ScopePilot was to make open-weight AI the actual engine of the application, rather than adding an AI feature just for the sake of it.

The AI Engine

I chose Gemma 3 1B, running locally through Ollama.

The application communicates with Ollama through its local REST API. The model processes client briefs through a structured generation pipeline.

I use Pydantic schemas to validate the generated output and Python services to handle proposal generation, pricing calculations, validation, and storage.

The model assists with understanding requirements and generating proposal content. Pricing calculations are handled deterministically in Python rather than blindly trusting the model's arithmetic.

Technology Stack

AI Model: Gemma 3 1B

Local Inference: Ollama

Backend & Application Logic: Python

User Interface: Streamlit

Data Validation: Pydantic

Storage: Local JSON-based persistence

PDF Generation: ReportLab

Testing: Pytest

Privacy-First Dual-Mode Architecture

One of the most important decisions was to preserve the local-first experience while making the project accessible to people who don't want to install anything.

I implemented two operating modes:

1. Local Mode

Real Gemma 3 1B inference through Ollama.

Local proposal storage.

Full proposal generation and editing.

Section regeneration.

PDF and Markdown exports.

2. Cloud Demo Mode

Interactive public demonstration.

Bundled sample proposals.

Session-only editing.

Sample PDF and Markdown exports.

No Ollama connection or external LLM inference.

No persistent visitor proposal storage.

This distinction is intentional. The hosted demo is transparent about what it can and cannot do, while the complete AI experience remains available locally.

Why Does Open Innovation Matter?

For this project, open innovation isn't just a technology preference. It's part of the product's business model.

Imagine a freelancer using an AI proposal generator for every new client. If every proposal requires a paid API request, the operating cost can become an ongoing expense.

By using Gemma 3 1B locally, ScopePilot can generate proposals without depending on a metered cloud LLM API.

There are three major advantages:

1. Privacy

Client briefs can contain sensitive business requirements, budgets, internal processes, and project details. Local inference allows this information to stay on the freelancer's machine.

2. Cost Control

Once the model is downloaded, local inference doesn't require paying an AI API provider for every generation. This makes the core AI functionality more accessible to independent freelancers.

3. Independence

ScopePilot doesn't depend on a single proprietary AI provider, its pricing changes, or its API availability. The model can be run locally, giving users more control over their tools.

Open-weight models made it possible to build an AI-powered product that prioritizes privacy, affordability, and user control from the beginning.

What I Learned

Building ScopePilot taught me that integrating an AI model is only one part of building a useful AI product.

The surrounding engineering matters just as much:

Validating unpredictable model outputs.
Keeping financial calculations deterministic.
Handling unavailable local models.
Separating confirmed requirements from AI-generated assumptions.
Designing a useful interface around AI-generated content.
Making privacy a core architectural decision rather than an afterthought.

I also learned that a good public demo doesn't necessarily need to expose a cloud AI endpoint. It can demonstrate the product honestly while preserving the full local experience.

Prize Categories

I'm submitting ScopePilot for:
**
Best Use of Gemma** — Gemma 3 1B is the core model powering local AI proposal generation.

I'm also entering the overall Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle.

Built with Python, Streamlit, Ollama, and Gemma 3 1B.

GitHub: https://github.com/sayuj5/ScopePilot