HermesSec: Turning Open-Weight Gemma & AST Triage into a $149 Freelance Security Audit Side Hustle

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle.

What I Built

Indie SaaS founders, vibe-coders, and small dev agencies ship payment and authentication code at breakneck speed. They cannot afford a traditional $15,000 penetration test before launching, yet a single SQL injection (CWE-89), hardcoded production secret (CWE-798), or shell=True command execution (CWE-78) can wipe out their business overnight.

On the flip side, freelance security practitioners want to offer affordable $149 Express Pre-Launch Code Audits—but manually reviewing snippets, mapping CWE identifiers, and writing copy-pasteable remediation patches takes hours of unbilled effort.

HermesSec bridges this gap. Inspired by the Hermes / OpenClaw multi-agent task decomposition workflow, it combines deterministic Python AST (Abstract Syntax Tree) pre-triage with Google Gemma open-weight models, Backboard's stateful thread memory (memory="Auto"), and Render cloud hosting to generate line-accurate, client-ready security audit reports in seconds.

Demo

• Live App on Render: https://hermes-sec-audit.onrender.com/
• Try it live: Click Sample 1 (SQLi + Secret) or Sample 2 (RCE / Command Inj), or paste your own custom Python code—the AST engine + Gemma pipeline will dynamically detect the exact line numbers and generate a tailored patch!

Code

• GitHub Repository: https://github.com/pr7426/hermes-sec-audit/tree/main
• Includes app.py (FastAPI + AST Triage + Backboard /api/threads/messages + Local Ollama /api/chat), Dockerfile, and render.yaml Blueprint.

How I Built It

HermesSec uses a three-stage sub-agent architecture designed for zero-hallucination reliability:

1. Sub-Agent 1 — Deterministic Python AST & Regex Triage: Parses incoming source code into an Abstract Syntax Tree (ast.walk) to pinpoint exact line numbers for dangerous sinks (eval, exec, pickle.loads, subprocess with shell=True, raw SQL string interpolation, and hardcoded secrets).
2. Sub-Agent 2 — Google Gemma Remediation Engine: Feeds the structured AST findings into open-weight gemma-2-9b-it (via Backboard or local Ollama /api/chat) to synthesize drop-in secure refactoring code and executive risk summaries.
3. Sub-Agent 3 — Backboard Stateful Memory & Model Benchmark: Uses Backboard's POST https://app.backboard.io/api/threads/messages endpoint with X-API-Key and memory="Auto" to retain recurring CWE context across audit threads and compare google/gemma-2-9b-it against qwen-2.5-coder-7b-instruct side-by-side.

Why Does Open Innovation Matter?

A freelance code auditing business cannot be built on closed commercial AI APIs for three practical reasons:

1. Client NDA & Source Code Privacy: Paying clients will never allow proprietary authentication or checkout code to be sent to closed-source frontier providers that retain prompts for training. Because HermesSec supports open-weight Gemma via local Ollama (http://localhost:11434/api/chat) or controlled endpoints, sensitive client code stays completely private.
2. No False-Positive Safety Refusals on Security Code: Closed commercial APIs frequently refuse to analyze legitimate SQL injection queries, XSS sinks, or command-injection snippets due to overly aggressive refusal guardrails. Open-weight models like Gemma let security engineers inspect and patch real vulnerabilities without arbitrary blocks.
3. 99% Gross Margin Unit Economics: Running a 9B open-weight model combined with local AST pre-filtering costs less than $0.0003 per audit, making a fixed-price $149 micro-audit highly profitable from day one.

My First User

I put the live Render deployment in front of a fellow developer and content creator who launches web apps and social e-commerce tools.

• How it went: They pasted a real backend utility script into HermesSec. Within 2 seconds, the tool flagged a hardcoded token and an unvalidated query line by exact line number, outputting the parameterized replacement code.
• Would they pay?: They said paying a flat $99–$149 for a verified pre-launch security sign-off before opening public access is an easy "yes" compared to enterprise consulting rates.
• What they asked for next: Automatic GitHub Pull Request webhook integration and downloadable PDF certificates they can show to their customers.

Prize Categories

• Best Use of Render: Deployed the containerized FastAPI + multi-agent runtime on Render using a native Dockerfile and render.yaml Blueprint.
• Best Use of Gemma: Used Google's open-weight Gemma (gemma-2-9b-it / gemma2:9b) as the primary vulnerability explanation and secure patch synthesis model.
• Best Use of Backboard: Integrated Backboard's POST /api/threads/messages API with X-API-Key and memory="Auto" to maintain stateful audit memory and compare open-weight models (gemma-2-9b-it vs qwen-2.5-coder) through a single key.