# 🚨 Oops, I Shipped a Secret. ChangeGuard Didn’t.

Challenge Intro

You know what’s fun?

Shipping code.

You know what’s less fun?

Realizing you just committed an API key, gave a Kubernetes container god mode, or turned your infrastructure into a security researcher’s weekend project. 💀

We have code reviews, CI pipelines, tests, and linting. Yet somehow, security issues still sneak into pull requests like they own the repository.

Meet ChangeGuard — because “it works on my machine” is not a security strategy.

What I Built

ChangeGuard is an open-source security scanner that catches risky changes before they become tomorrow’s incident report.

It helps developers detect security issues, review changes, and enforce security policies directly in their development workflow.

What it does:

• 🔑 Secret Detection: Finds suspicious hardcoded credentials before they get a permanent home in Git history.
• ☸️ Infrastructure Security: Detects risky Kubernetes and Terraform configurations. Because running containers in privileged mode should be a decision, not an accident.
• 🔍 Diff Risk Analysis: Highlights newly introduced security findings so developers can focus on what actually changed.
• 🚦 Policy-Based CI/CD: Integrates with GitHub Actions to fail checks when changes violate configured security policies.
• 📜 Scan History: Keeps a record of previous scans and findings. Apparently, “I thought we fixed that” isn't an audit trail.
• 🛠️ Configurable Security Policies: Lets teams define which findings should block a change.
• 🤖 Optional Local AI Explanations: Supports local Ollama-powered explanations, so developers can better understand security findings without necessarily sending code to a hosted AI service.

The goal isn't to replace security engineers. It's to stop making them discover privileged: true during a production incident.

Demo

🎬 Live Demo: https://drive.google.com/drive/u/1/home

Live Website: http://change-guard-beta.vercel.app/

The ideal demo flow:

1. Introduce an insecure Kubernetes configuration.
2. Run ChangeGuard and inspect the detected risk.
3. Introduce a secret-like value and see how the scanner flags it while redacting sensitive evidence.
4. Review the scan history and policy decision.
5. Push a risky change and watch GitHub Actions enforce the configured policy.

Green checks are nice. Green checks that actually mean something are better.

Code

💻 GitHub Repository: https://github.com/praniket01/ChangeGuard

The project is built with a separate frontend and backend:

• Frontend: Next.js, TypeScript, and a neon-inspired security dashboard.
• Backend: Python, FastAPI, and Pydantic.
• Security Analysis: Rule-based scanning for secrets and risky infrastructure configurations.
• Persistence: SQLite-backed scan history and policy configuration.
• CI/CD: Python scanning script integrated with GitHub Actions.
• AI: Optional local Ollama integration for explanations.

How I Built It

I wanted to build something that fits into a developer's existing workflow rather than another dashboard that looks impressive and gets opened twice.

So, I built ChangeGuard around a simple idea: security checks should happen when code changes, not when someone finally notices the consequences.

The backend exposes API endpoints for scans, diff analysis, policy management, and history. The frontend provides a dashboard to interact with those features. A standalone scanner can also inspect repository changes in CI and return a failing exit code when the configured policy blocks the findings.

I added secret redaction to avoid echoing detected credential values into reports, and persistent storage for scan history and policies.

The scanner is deliberately designed as a practical first layer of defense. Its rule-based checks are transparent and easy to extend, while optional local AI explanations can help developers understand why a finding matters.

Is it a replacement for a full enterprise security platform? No.

Is it better than discovering a leaked credential after your repository has been starred by half the internet? Absolutely.

Why Does Open Innovation Matter?

Security shouldn't be a luxury feature reserved for teams with enormous budgets and dedicated security departments.

Open-source tools let developers inspect the rules, improve detection, report false positives, and adapt policies to their own environments.

ChangeGuard is my contribution to that ecosystem: a project that developers can learn from, extend, and use to make security a normal part of development rather than a last-minute ritual.

The more people who can improve the tool, the more edge cases we can catch—and the fewer production incidents have to become cautionary LinkedIn posts.

Final Note

ChangeGuard is built on a simple belief:

Your CI pipeline should be the bouncer at the door—not the person filing the incident report the next morning.

If you're building with Kubernetes, Terraform, or secret-heavy application configurations, give ChangeGuard a try, open an issue, or contribute a rule.

Let's make “works on my machine” a development milestone, not a security verdict. 🛡️