I built a Mac AppSec tool where the AI never sees your whole repo

Yaman Khetan — Fri, 25 Sep 2026 13:47:27 +0000

Most AppSec pipelines assume one thing first: upload the repo.

That breaks for NDA client code, regulated workloads, or a policy that source does not leave the building. SaaS scanners want the tree. On-prem enterprise gear assumes you have a security department. A lot of solo founders and small teams sit in the gap.

I built InsurStaq — a local-first security auditor for macOS (Apple silicon) to sit in that gap.

The order of operations matters

The product is deliberately not LLM over the repo.” The loop is:

Parse and map the application (routes, auth, frameworks via tree-sitter adapters).
Run deterministic scanners — first-party SAST, secrets (including git history), IaC / container / CI checks, offline OSV CVEs, SBOM export.
Build a code + security graph and trace source→sink attack paths (inter-procedural taint), not only rule hits.
Only then feed a local model an evidence packet — explain, triage, draft a minimal patch.
You approve → atomic apply → rescan to verify.

The model never gets the whole repository as context. Scanners find; the model reasons over a bounded packet with schema-validated output. That keeps it grounded and small enough for a laptop (bundled llama.cpp sidecar, or your own Ollama / LM Studio on loopback).

Privacy is structural, not a checkbox

One allowlisted outbound gateway with a ledger; request types that must not carry repo content do not.
Air-Gapped Mode turns networking off.
Encrypted local store + Keychain.
Read-only Git via vendored libgit2 (no hooks/filters, no fetch/push).

What it is / is not

Is: local SAST-style coverage + attack-path tracing + approval-gated remediation + compliance readiness mapping (OWASP / ASVS / CWE / SOC 2 / ISO 27001 / PCI / GDPR / HIPAA as evidence states, not badges).
Is not: a penetration test. Not a certification. Early access: licence + download by email. Framework coverage is uneven — I’d rather hear what you need than overclaim.

Reports: PDF, HTML, Markdown, JSON, SARIF, CSV. CLI can fail CI on critical findings.

How KarmSakha Built a Mobile-First EdTech Platform for Bharat

Yaman Khetan — Sat, 27 Jun 2026 09:40:33 +0000

Most ed-tech builders in India think about the top of the pyramid — JEE, NEET, CAT. The students with laptops, stable WiFi, and parents who understand what a percentile means.

We built KarmSakha for the other side of that pyramid.

The Problem We Noticed

Government job preparation in India is a massive, underserved market. Over 20 million people appear for Sarkari exams every year — SSC, Railways, Banking, State PSCs, Police, Insurance. These are not students from elite colleges. They are often first-generation learners, working adults, people from districts with no quality coaching infrastructure.

The tools available to them were either too expensive, too scattered, or too generic. A platform built specifically for this segment — mobile-first, bilingual, affordable, exam-specific — simply did not exist at scale.

What We Built

KarmSakha is a mobile-first government job preparation platform. Here is what the stack looks like from a user's perspective:

Job Discovery: Live vacancy tracking from official portals like ssc.nic.in and rrbcdg.gov.in. Filtered by qualification, state, pay scale, and last date.
Mock Tests: Exam-specific test series for ITI NIMI, SSC CGL, SSC CHSL, SSC GD, RRB NTPC, IBPS PO, IC38 Insurance, and more. 5,308+ questions across 61 tests.
Courses: Bilingual (Hindi + English) structured courses with chapter-wise tests, notes, and score analytics.
eBook Vault: Downloadable study material organised by exam.
Tools: Typing test, Unicode/Kruti Dev converters, resume templates, current affairs.

The Mobile-First Decision

This was non-negotiable. A large majority of our users access the platform from Android phones with limited data. Every feature had to work on a 4G connection with a mid-range device. No heavy frameworks that take eight seconds to load. No PDFs that need a desktop to read properly.

The Career Pass — our yearly subscription at Rs. 1,999 — was priced specifically so a student in a small town could afford it without asking their parents twice.

Lessons For Bharat-First Builders

Bilingual is not optional. If your content is English-only, you have already excluded most of the audience that needs you.
Optimise for the cheapest device, not the best one. Your power users are on entry-level Android, not flagship phones.
Pricing is a product feature. Rs. 1,999 versus Rs. 19,999 is not just a number — it decides who can even consider you.
Solve the whole journey. Discovery plus preparation plus practice in one place beats five disconnected tools.

Where We Are

Over 1.2 million aspirants have used KarmSakha. More than 48,000 have cleared government selections. We are a small, bootstrapped team based in Surat, Gujarat.

We are not trying to out-feature the big platforms. We are trying to be the most useful tool for one specific group of people. So far, that focus seems to be working.

If you are building in the ed-tech or civic-tech space in India, or if you are an aspirant yourself, come check out what we have built at karmsakha.com.

Happy to answer any questions in the comments.

DEV Community: Yaman Khetan