I built CyberShield AI because the security tools I kept using were either too narrow (one tool for secrets, another for CVEs, another for SAST) or too expensive. CyberShield pulls all of it into one place with an AI layer on top that actually explains what it finds in plain English, not just dumps a list of CVE numbers at you.
The target user is a developer who wants to check their own code before it ships — not a dedicated security team with enterprise tooling. It's self-hosted, runs in Docker, and gives you actionable output rather than walls of raw scanner output.
🛠️ What it scans:
Secrets and Credentials — Regex and entropy-based detection for API keys, tokens, private keys, connection strings, and passwords hardcoded anywhere in your codebase.
Static Code Analysis — Pattern matching against OWASP Top 10 vulnerabilities: SQL injection, command injection, XSS, and more across Python, JavaScript, TypeScript, Go, and Java .
Dependency CVEs — Reads your requirements files and package manifests, checks each dependency against the OSV.dev database .
AI Security Review — Goes beyond pattern matching. Catches things like "this looks like a race condition that could allow privilege escalation" that a regex pattern would miss .
Remediation Suggestions — For every finding, it tells you what to change. Not just "this is a SQL injection" but "replace this f-string with a parameterized query" .
Report Generation — Produces clean HTML security reports you can share or save.
🧰 Tech Stack
Python, FastAPI, OWASP dependency-check, OSV.dev API, Redis, and optional Ollama for AI features.
🔗 Get Started
Check out the repo: github.com/isidhartha/cybershield-ai
Top comments (0)