SlothSec: Your Local AI Security Analyst That Finds and Fixes Vulnerabilities 🦥🔐

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

Security vulnerabilities are easy to introduce and surprisingly easy to overlook.

Developers often have to switch between multiple security tools, manually interpret hundreds of findings, understand the root causes, and figure out how to fix them. For individual developers and small teams, maintaining this workflow can become time-consuming.

That's why I built SlothSec — a local-first, AI-powered application security analysis and remediation platform.

SlothSec brings multiple security tools together into one dashboard. It scans local repositories, identifies vulnerabilities, uses a locally running AI model to explain security findings, and helps developers generate and apply potential fixes.

The goal is simple: make security analysis less complicated and help developers spend less time investigating repetitive findings.

What can SlothSec do?

• Repository Management: Register and manage local repositories with path validation and security checks.
• Multi-Scanner Engine: Run Semgrep for Static Application Security Testing (SAST), OSV-Scanner for dependency vulnerabilities (SCA), and Gitleaks for exposed secrets.
• Finding Deduplication: Identify duplicate findings across repeated scans using fingerprint-based matching.
• AI Security Analyst: Use a locally hosted Qwen3 model through Ollama to analyze vulnerabilities, explain root causes, assess potential exploitability, and recommend remediation steps.
• AI-Powered Remediation: Generate suggested code patches, review unified diffs, approve changes, and verify fixes through rescanning.
• Automated Security Scans: Schedule recurring repository scans using cron-based automation.
• Security Reports: Export findings and analysis as JSON or PDF reports.
• Observability: Monitor scan execution, application metrics, and OpenTelemetry traces.

The important part is that SlothSec doesn't just tell developers that something is wrong. It helps them understand why it matters and what they can do about it.

Demo

Local demonstration: SlothSec currently runs locally.

• Frontend Dashboard: http://localhost:5173
• Backend API: http://127.0.0.1:8000
• API Documentation: http://127.0.0.1:8000/docs
• Local AI Engine: Ollama

The project has passed its initial validation:

• Backend starts successfully.
• Frontend production build completes successfully.
• All 10 automated tests pass.
• Semgrep, OSV-Scanner, and Gitleaks are detected and available.
• Local Qwen3:4b inference is working through Ollama.
• The dashboard successfully retrieves real scan findings.

Screenshots:

Code

GitHub Repository: https://github.com/sayuj5/SlothSec.git

The project is organized into two main parts:

• backend/ — FastAPI backend, database models, security scanners, AI analysis, remediation engine, reporting, scheduling, and observability.
• frontend/ — React and TypeScript dashboard with repository management, scan monitoring, vulnerability analysis, remediation workflows, and reports.

The repository also includes automated tests, configuration examples, and development scripts.

How I Built It

I wanted SlothSec to be more than another AI wrapper around a security scanner. The idea was to create a complete security workflow where deterministic security tools identify issues and an AI model helps developers understand and address them.

Technology Stack

Component	Technology
Backend	Python, FastAPI
Frontend	React, TypeScript, Vite
Database	SQLite, SQLAlchemy
AI Model	Qwen3:4b
Local Inference	Ollama
SAST	Semgrep
Dependency Scanning	OSV-Scanner
Secret Detection	Gitleaks
Scheduling	APScheduler
Observability	OpenTelemetry
PDF Reports	ReportLab

The AI Pipeline

SlothSec uses Qwen3:4b through Ollama for local AI-powered vulnerability analysis.

The workflow is designed around three main stages:

1. Detection: Security scanners identify vulnerabilities, insecure code patterns, dependency risks, and exposed secrets.
2. Analysis: The AI analyst receives structured finding information and generates an explanation containing an executive summary, root cause, exploitability assessment, and remediation recommendations.
3. Remediation: The platform generates a proposed unified diff that developers can review before approving and applying it. A subsequent scan helps verify whether the issue has been resolved.

The AI is an assistant rather than the source of truth. Security findings originate from dedicated scanning tools, while the LLM helps interpret those findings and propose fixes.

Why Local AI?

One of my main design decisions was to avoid depending on cloud-based AI APIs.

Using Ollama and Qwen3:4b allows SlothSec to perform AI analysis locally. This helps keep repository information and source code on the developer's machine rather than sending it to an external AI provider.

It also means there are no recurring AI API costs for the local inference workflow.

The project is designed to work without cloud storage or mandatory external AI services.

Why Does Open Innovation Matter?

Open innovation was an important part of building SlothSec.

Security tooling should be accessible to developers regardless of their budget or access to commercial platforms.

Here are a few things open-source technology made possible:

1. No dependence on a single security vendor

Semgrep, OSV-Scanner, and Gitleaks each specialize in different areas of application security. Combining them provides a broader analysis workflow without relying on one proprietary scanner.

2. AI without mandatory cloud APIs

Qwen3 is available as an open-weight model, and Ollama makes local inference accessible. Developers can experiment with AI-assisted security analysis without requiring a paid hosted AI API.

3. Transparency and customization

The scanning workflow, AI prompts, remediation logic, and application architecture can be inspected and modified. Developers can adapt the platform to their own repositories and security requirements.

4. Accessible security automation

By combining open-source scanners, a local database, and automated scheduling, SlothSec makes several security workflows accessible without expensive enterprise infrastructure.

I believe open innovation makes security tools more approachable, transparent, and adaptable.

The Lazy Payoff

The idea behind SlothSec is to make developers a little lazier about repetitive security work, but more proactive about fixing vulnerabilities.

Instead of manually running different scanners, switching between their reports, researching every finding, and writing fixes from scratch, developers can manage the workflow from one place.

SlothSec brings detection, analysis, remediation, verification, and reporting together.

The initial implementation is operational, with 10 automated tests passing and real scanner findings successfully appearing in the dashboard.

There is still room to improve the AI's remediation accuracy and expand scanner coverage, but the foundation is ready for further development.

Less manual investigation. More time building. Better security habits.

Prize Categories

• Hacktoberfest Open-Source AI Challenge — Week 3: Slow and Steady

SlothSec uses the open-weight Qwen3:4b model through local Ollama inference to automate security analysis and remediation without relying on paid cloud AI services.

Built with open-source security tools, local AI, and a simple philosophy: security should be part of the development workflow, not an afterthought.

🦥 SlothSec — Slow down. Scan deeper. Ship safer.