What I Built
A production incident at 3:14 AM
If you’ve ever been on call, you already know the drill: one minute it's a peaceful night, and the next, your screen is an angry wall of red alerts.
A few months back, I was watching our auth service choke on database syntax errors. Sessions were dying, the logs were overflowing, and our tired team was frantically trying to make sense of the chaos.
Your first instinct in that situation is usually to just copy-paste the whole stack trace into an AI assistant and beg for a solution. But for us, that wasn’t an option. Our security policies are strictly zero-trust: no internal code, no customer data, and definitely no raw production logs are allowed to hit a third-party AI model. You never know what’s hiding in a log line—a stray auth token, a customer's payload, or sensitive internal network details.
So, we did it the old-fashioned way: manually grep-ing through logs, tracing the failure back through the codebase, and trying to figure out if we were dealing with a security breach or just a bad code push.
That miserable 3 AM experience got me thinking: what if a local AI model could do this heavy lifting, completely offline? That question turned into GhostAudit.
Meet GhostAudit
GhostAudit is a local incident-triage prototype powered by Google’s Gemma models. The whole point is to give developers an AI debugging buddy that lives entirely on their own machine—perfect for environments where cloud AI is a strict no-go.
Live Deployed App (Vercel): https://ghostaudit-alpha.vercel.app
GitHub Repository: https://github.com/nitesh5651mondal/ghostaudit
It runs 100% offline. Just to be extra safe, before the model even sees your data, a pre-inference sanitizer scrubs the logs for obvious things like cloud credentials, JWTs, and private IPs. It’s a helpful safeguard to keep secrets out of the prompt, though it shouldn't replace common sense.
To keep the AI focused, I split the triage pipeline into three distinct roles:
[ Incident logs + relevant source code ]
│
▼
[ Pre-inference secret and PII checks ]
│
▼
[ Argus: log and telemetry review ]
│
▼
[ Cerberus: code and security review ]
│
▼
[ Prometheus: proposed patch ]
│
▼
[ Git diff + incident report for review ]
The Three Roles
👁️ Argus — log review
Argus digs through the noise to find the signal. It looks for exactly when things broke, groups related events together, and spots suspicious inputs (like a nasty SQL injection string). It doesn't solve the problem; it just gives you a solid lead to investigate.
🛡️ Cerberus — security review
Cerberus takes those leads and looks at your source code. It acts as your security auditor, flagging potential weaknesses, guessing the CWE category, and estimating a CVSS severity score. Treat this as a second opinion, not absolute truth—you still need to verify its claims against the actual codebase.
⚡ Prometheus — patch proposal
Prometheus tries to actually fix the mess. It drafts a unified diff—like swapping out a sloppy interpolated string for a parameterized query. It's a great starting point to get you moving, but you should always review and test the patch before blindly pushing it to prod.
Demo
I really didn't want this to just look like another AI chat window with a dark theme. I wanted it to feel like a legit security operations center (SOC) tool.
Live app: ghostaudit-alpha.vercel.app
Source code: github.com/nitesh5651mondal/ghostaudit
Here are a few parts of the demo you can play around with:
Risk radar: A live, animated map of your assets and incident risks that updates in real-time as you triage.
Tri-agent triage: Watch Argus, Cerberus, and Prometheus tag-team an incident handoff.
Exposure analysis: Throw some sample logs at it and watch the sanitizer work (just please don't paste real production secrets into a public demo!).
Incident dashboard: Check out telemetry indicators, cluster status, and saved incident reports.
Attack path graph: A visual breakdown of how a bad request travels from the edge to your database.
Telemetry feed: Search and filter a streaming-style log view, then kick selected entries straight into triage.
Report and patch export: Generate a clean Markdown summary of the incident and copy the proposed fix.
Working with Gemma locally
Under the hood, I’m running Gemma 2 (both the 2B and 9B variants) locally via Ollama, glued together with a Python orchestration layer. Since not everyone has a beefy GPU lying around, I added a deterministic fallback mode so people can still click through the demo without their laptop melting.
Honestly, the coolest part of this experiment was seeing just how capable a small, local model can be when you give it a highly specific job. It cleaned up messy stack traces, compared queries against safer design patterns, and drafted solid patches without breaking a sweat. It still needs a human in the loop, but it proved to me that local AI is incredibly viable for defensive engineering.
Running things locally definitely changes the math: you trade the per-request API bill for local hardware requirements. But for teams with strict compliance and privacy rules, keeping that analysis on-machine is a massive advantage.
What I learned
Building GhostAudit was a perfect collision of my favorite things: software engineering and sec-ops. The hardest part wasn’t getting the LLM to output text—it was choreographing the handoffs between the three agents and making sure the context actually flowed between them usefully.
Designing the radar and incident views was a blast, but the core challenge was making sure the AI's output was highly reviewable. A generated vulnerability label or patch can look incredibly confident and still be completely wrong. GhostAudit is best viewed as a triage assistant: it points you in the right direction, but you are still the engineer in charge of the fix.
This project gave me a real appreciation for what open-weight models can do for security workflows. Moving forward, I want to refine the sanitization checks and test the agents against wilder, more complex log formats. For me, the takeaway is clear: local AI can completely change how we handle sensitive debugging, without ever sending a single log line to the cloud.
Top comments (0)