GitLatch : Your Repository Guard

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

GitLatch is an enterprise-grade, client-side Static Application Security Testing (SAST) platform and repository governance engine designed to conduct exhaustive, automated audits of continuous integration pipelines and software supply chains entirely on the user's local machine. Powered by Google DeepMind's Gemma 4 E2B large language model executing natively inside the web browser through Google LiteRT-LM (@litert-lm/core) over WebGPU, GitLatch scrutinizes repository configurations, GitHub Actions workflows, composite actions, and multi-ecosystem manifest files without transmitting a single byte of proprietary source code, operational workflows, or confidential environment secrets to external cloud infrastructure.

Problem Statement

Modern software engineering teams rely extensively on automated Continuous Integration and Continuous Delivery (CI/CD) pipelines to compile code, execute test suites, publish release artifacts, and provision production infrastructure. However, automated build workflows have rapidly evolved into the primary and most vulnerable attack vector for modern software supply-chain compromises. GitHub Actions workflows routinely execute untrusted third-party shell scripts using unverified remote piping mechanisms such as curl | bash pipelines devoid of cryptographic signature checks, checksum validations, or execution sandboxing. Furthermore, development teams frequently reference external marketplace actions pinned exclusively to mutable version tags (such as @v1 or @v4) rather than immutable, full-length 40-character commit SHAs, exposing automated runners to silent upstream tag overwrites, compromised maintainer accounts, and automated credential exfiltration.

These uninspected external scripts and custom actions execute with excessive, broad runner privileges that possess direct, unmonitored access to sensitive repository secrets, deploy keys, cloud production credentials, and write-enabled GITHUB_TOKEN authorizations. Traditional static application security testing tools focus almost exclusively on high-level application source code while treating CI/CD automation files as invisible configuration scripts. Consequently, security engineers and maintainers face a dangerous lack of visibility, operating without an automated, preemptive inspection layer capable of detecting malicious script injections, excessive permissions, untrusted event triggers such as pull_request_target, and covert dependency confusion vectors before they compromise production build pipelines.

Solution Approach

GitLatch addresses this critical vulnerability by delivering a multi-stage security audit engine that enforces infrastructure-as-code and workflow governance with the identical rigor applied to production application code. Rather than performing superficial regular expression matches on isolated workflow definitions, GitLatch recursively crawls the entire repository tree to catalog and analyze every asset residing within the complete .github/ directory. This comprehensive crawl encompasses continuous integration workflows, composite actions, Dependabot configurations, bespoke maintenance shell scripts, and administrative governance policies including CODEOWNERS and SECURITY.md.

Simultaneously, GitLatch discovers and parses software supply-chain manifests spanning diverse programming languages and package ecosystems, including Node.js (package.json and lockfiles), Python (requirements.txt, pyproject.toml, Pipfile, and setup.py), Go (go.mod), and Rust (Cargo.toml). The engine processes these artifacts through a synchronized audit pipeline that fuses deterministic static heuristics with contextual neural evaluation. Deterministic parsers identify overt vulnerabilities including wildcard version constraints, dangerous pre/postinstall lifecycle hooks, unscoped internal packages, self-hosted runner risks, and remote piping scripts, while the on-device Gemma neural engine interprets complex execution topologies, shell interpolations, and contextual injection surfaces to deliver granular vulnerability summaries and actionable remediation diffs.

Why We Are Unique

GitLatch establishes an uncompromising, zero-trust client-side privacy model that guarantees complete computational sovereignty on the developer's workstation. While existing enterprise security suites mandate organization-wide read/write permissions, code repository mirroring, and bulk transmission of sensitive workflows to proprietary third-party artificial intelligence cloud platforms, GitLatch performs one hundred percent of its reasoning on-device using local WebGPU acceleration. Proprietary business logic, internal infrastructure addresses, automated deployment routines, and inadvertent secret leaks never cross the boundary of the local browser sandbox.

Beyond client-side privacy, GitLatch delivers publication-grade audit transparency through a native generation engine that compiles formal security reports into a standardized A4 portrait PDF adhering to strict 1.0-inch (25.4mm) margins on all four borders. Designed around high-density monospace Courier typography and explicit, bordered tabular matrices, the exported audit report documents discovered vulnerabilities, runner contexts, affected file paths, and exact remediation advice without token overflow or column clipping. This equips engineering teams, compliance officers, and open-source maintainers with an immutable, audit-ready artifact suitable for compliance verification, SOC2 documentation, and third-party penetration disclosures.

Tech Stack

• Core Application Framework: Next.js 15 (App Router), React 19, TypeScript 5
• Styling & Visual Interface: Tailwind CSS v4, Lucide React, React Icons (FaGithub), next-themes
• Database & Data Persistence: MongoDB, Mongoose (with connection caching and connection pooling)
• Authentication & Session Guard: NextAuth v5 (GitHub OAuth Provider), Next.js Edge Middleware
• On-Device Neural Security Engine: Google DeepMind Gemma 4 E2B (.litertlm artifact ~1.87 GB)
• Client Inference Runtime: Google LiteRT-LM (@litert-lm/core) via WebGPU Compute Shaders
• Model Storage & Persistence: File System Access API (showDirectoryPicker), Origin Private File System (OPFS), IndexedDB
• Formal Audit Report Generator: jsPDF (monospace bordered grid engine), @react-pdf/renderer
• Code Quality & Linter Engine: Biome 2.2.0 (strict code formatting and automated linter verification)

Technical Feasibility and Impact of Gemma

The computational foundation of GitLatch is Google DeepMind's Gemma 4 E2B model, a specialized two-billion parameter neural network designed for high-density edge reasoning and instruction-tuned code analysis. By compiling the Gemma 4 architecture into the highly optimized .litertlm binary format, GitLatch achieves workstation-class static analysis capabilities directly inside consumer web browsers without requiring dedicated cloud server clusters or specialized AI hardware. The model harnesses modern client graphics processors via WebGPU compute shaders, delivering low-latency, real-time inference that operates reliably within client memory boundaries.

The true operational impact of this architecture lies in its offline-first, low-bandwidth paradigm. Following a single initial download of the compressed 1.87 GB model artifact, GitLatch utilizes the modern browser File System Access API with Origin Private File System (OPFS) fallback to persist model weights permanently on the user's local disk. This eliminates ongoing bandwidth consumption, enabling security teams to audit proprietary repositories aboard aircraft, inside air-gapped security enclaves, or across low-connectivity development environments. Furthermore, client-side inference ensures absolute operational consistency, completely immunizing the security scanner against cloud configuration drift, provider API rate limiting, unexpected backend model deprecations, and fluctuating subscription charges.

On-Device Inference Engine and Live Streaming Protocol

The runtime execution architecture of GitLatch couples high-throughput edge model distribution with an on-device WebGPU live streaming inference protocol, orchestrating deep repository audits with continuous, real-time telemetry across both network transport and hardware compute layers.

Akamai Pipeline Operation Monitoring

The delivery of Google DeepMind's Gemma 4 E2B model weights (~1.87 GB), tokenizer metadata, and WebAssembly execution binaries is governed by an Akamai-accelerated edge distribution pipeline designed to provide rapid, uninterrupted binary transmission directly to client browsers. This delivery infrastructure is actively monitored through a dedicated chunk-level watchdog telemetry system executing within the client browser. Rather than relying on monolithic, unmonitored file downloads that frequently stall or corrupt under volatile network conditions, the Akamai pipeline streams data in discrete binary chunks while continuously measuring real-time throughput, byte-by-byte transfer progress, and connection latency. The client watchdog enforces strict 35-second chunk timeout intervals alongside 60-second storage flush thresholds, immediately detecting packet stalls, transient dropped sockets, or edge throttle events.

When browser-enforced Cross-Origin Resource Sharing (CORS) constraints or restrictive corporate network proxies impede direct connection to public model repositories, the pipeline activates an automated edge-proxy failover route through the application's internal streaming endpoint. To safeguard local persistence integrity across Windows and Chromium environments, the storage monitor actively oversees filesystem handle transitions, purging orphaned temporary .crswap artifacts prior to write initialization, verifying directory handle permissions via the File System Access API, and executing seamless automatic failover to the Origin Private File System (OPFS) whenever desktop directory access is restricted. Each retrieved byte range undergoes continuous size verification against cryptographic artifact headers, preventing partial writes and guaranteeing that corrupt weight matrices never enter GPU compute memory.

Live Streaming Inference and Execution Monitoring

Once model weights are committed to local origin storage and mapped into graphics memory, the Google LiteRT-LM WebGPU execution runtime coordinates a token-by-token live streaming inference protocol that provides continuous visibility into repository scanning operations. As the multi-stage auditor parses complex CI/CD workflow trees and multi-ecosystem dependency manifests, the neural engine streams reasoning tokens asynchronously into the client interface, providing developers with live, real-time audit feeds, instantaneous risk classifications, and streaming remediation diffs rather than opaque, delayed batch reports. The streaming protocol monitors time-to-first-token latency, per-second token generation velocity, and parsing stage durations, allowing the interface to render smooth micro-animations and active step progression as every file is processed.

Underpinning the streaming inference protocol is an active WebGPU device and VRAM telemetry monitor that tracks hardware adapter health and compute pass execution. Because scanning dozens of large workflow YAML files, composite actions, and lockfiles within a single scan session can quickly saturate client GPU memory, the GitLatch execution supervisor implements an automated Key-Value (KV) cache reset protocol. After the neural audit of each individual file concludes, the supervisor disposes of prior conversation context, flushes the active KV cache buffers, and reallocates a pristine context window capped at 4096 input and 2048 output tokens. This prevents cumulative GPU out-of-memory errors, eliminates cross-file prompt bleeding, and guarantees consistent, deterministic audit accuracy across the entire repository lifecycle. Furthermore, the runtime continuously listens for catastrophic device.lost hardware disconnect signals, providing automated recovery pathways that gracefully alert the operator without freezing the client application.