This project is submitted for the **Hacktoberfest 2026 โ Week 3: Open-Source AI Challenge* (#hf26challenge).*
๐งญ The Dilemma: Why Code Security Demands Open-Source AI
In the spirit of Hacktoberfest's 'Slow and Steady' sloth philosophy: moving too fast and breaking things is how API keys leak and injection flaws reach production. SecureScope brings steady, methodical, privacy-preserving AI audits to your workflow โ because slow and steady wins the security race. ๐ฆฅ
Every developer knows the sinking feeling of discovering an unintentional security vulnerability in production. Maybe it was an unescaped SQL parameter, a leaked API key in a configuration file, or an insecure deserialization call that slipped past code review.
Naturally, the industry has turned to AI for code analysis. But today's commercial AI code scanners present a painful paradox:
To find vulnerabilities in your private code, you must upload your entire proprietary codebase to a third-party closed-source cloud.
For individual open-source developers, privacy-conscious startups, and regulated industries (fintech, healthcare, defense), this is often an unacceptable trade-off. Your intellectual property is transferred over the wire, subject to third-party retention policies, vendor rate limits, and recurring subscription bills.
I built SecureScope to break this trade-off.
SecureScope is an open-source, local-first code security intelligence agent built with Google Gemma 2 at its core. It scans code across 6+ languages, screens vulnerabilities with a microsecond regex pre-filter, verifies threats using specialized open-weight AI personas, audits dependencies against the open-source Google OSV database, grounds findings in live SerpApi CVE data, generates unified git diff patches, enforces Git pre-commit hooks, and synthesizes executive voice briefings with ElevenLabs โ all while keeping your source code strictly under your control.
๐ Target Prize Categories
SecureScope was intentionally engineered to highlight open-weight AI and partner ecosystems:
| Category | Partner / Tech | How SecureScope Leverages It |
|---|---|---|
| ๐ Best Use of Gemma ($200) |
Google Gemma 2 (gemma2-9b-it) |
Primary open-weight foundation model driving vulnerability verification, false-positive elimination, confidence scoring, and drop-in code fix generation. |
| ๐ Best Use of SerpApi ($100) | SerpApi | Live search agent querying NIST NVD, MITRE CWE, and GitHub Advisories to enrich findings with verified CVE data and security research links. |
| ๐๏ธ Best Use of ElevenLabs ($100) | ElevenLabs | Executive voice audio security briefing (--voice), converting complex scan diagnostics into clear spoken debriefs (.mp3). |
| ๐ Best Use of GitHub ($100) | GitHub Ecosystem | Complete GitHub integration: SARIF 2.1.0 alerts in GitHub Code Scanning, automated CI/CD security gating workflow, and one-click Git Pre-Commit Hooks. |
๐ก Why Open Innovation Matters for SecureScope
The core prompt for Week 3 asks: Where does an open-based approach work better than a closed one? Here is the direct engineering reality:
1. Does it run on a laptop with no internet?
Yes, 100%. Using Ollama, SecureScope downloads Google Gemma 2 once and runs completely offline:
python cli.py --path ./my-project --provider ollama --model gemma2 --output all
Whether you are on an airplane, in an air-gapped lab, or working remotely without Wi-Fi, the entire audit pipeline โ from file discovery to AI reasoning, SARIF export, and HTML report generation โ executes locally on your CPU/GPU.
2. Does it keep data off servers you don't control?
Absolutely. Your code never leaves localhost. No proprietary logic, internal database connection strings, or architectural secrets are transmitted to closed-model API providers or stored in external prompt logs.
3. Does it allow model swapping and custom agent behavior?
Yes. Closed platforms lock you into their choice of model. SecureScope uses a modular adapter architecture. Want to switch from Google Gemma 2 to CodeGemma, or test a custom security fine-tune? Simply pass a flag:
python cli.py --path . --provider ollama --model codegemma
The specialized security prompts (analyzer/prompts.py) are fully open-source and customizable for team-specific coding standards.
4. Does it cost nothing to run?
Zero marginal cost. Running commercial API audits across high-frequency CI/CD pipelines can cost hundreds of dollars monthly in token usage. Running Gemma 2 locally or via generous free open-model endpoints means maintainers and students can run unlimited scans for $0.
๐ Direct Comparison: Closed SaaS vs. SecureScope
| Capability | Traditional Closed SaaS SAST | SecureScope (Open-Weight AI) |
|---|---|---|
| Code Privacy | Code uploaded to vendor cloud | Zero code leaves your machine |
| Offline Execution | โ Impossible | โ 100% offline with Ollama |
| Model Transparency | Black-box commercial LLM | Open-weight Google Gemma 2 |
| CVE Validation | Static rule matching | Live SerpApi search + NIST links |
| Supply Chain (SCA) | Expensive add-on tier | Free Google OSV database audit |
| Auto-Remediation | Static hints | Unified Git patches (.patch) & auto-fix (.bak) |
| Pre-Commit Guard | Complex enterprise setup | One-click install (--install-hook) |
| Audio Debrief | โ None | ElevenLabs Executive Briefing |
| GitHub Native | Proprietary dashboards | OASIS SARIF 2.1.0 Code Scanning |
| Cost at Scale | $50 โ $500 / month / seat | $0.00 (Self-hosted & open-source) |
๐๏ธ Architecture: How SecureScope Operates
SecureScope avoids brute-forcing entire repositories into an LLM context window. Instead, it utilizes an efficient multi-stage security pipeline:
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Target Codebase / Repo โ
โโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโ
โ
1. Git-Aware File Walker
(respects .gitignore,
supports --diff mode)
โ
โผ
2. Regex Pre-Filter Engine
(Screens 200+ patterns;
skips clean files in <1ms)
โ
โผ
3. Google Gemma 2 Analysis
(Multi-Role AI Security Agent)
โโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโ
โผ โผ โผ
Role 1: Secrets Role 2: Injection Role 3: Auth & SSRF
โโโโโโโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโโโโโโ
โ
4. Live Threat Grounding (SerpApi)
(Fetches NIST NVD & MITRE CVEs)
โ
โผ
5. Supply Chain Auditing (Google OSV)
(Audits requirements.txt & package.json)
โ
โผ
6. OWASP Top 10 Mapping
(A01:2021 to A10:2021)
โ
โผ
7. Multi-Modal Reporting
โโโโโโโโโโโโโโฌโโโโโโโโโโโโโโฌโโโโโโโโโโโโโโ
โผ โผ โผ โผ
Rich Terminal SARIF 2.1.0 Interactive ElevenLabs
Dashboard (GitHub) HTML Report Voice Debrief
โ
โผ
8. Automated Remediation Engine
(Unified .patch & safe .bak fixing)
Stage 1: Git-Aware File Traversal & Diff Mode
The file walker (scanner/file_walker.py) queries git ls-files to automatically honor .gitignore rules, skips build artifacts (node_modules, dist, venv), and includes a --diff mode that scans only staged files in milliseconds.
Stage 2: Sub-Millisecond Regex Pre-Filter
Scanning clean files with an LLM is slow and wasteful. SecureScope runs language-specific regex rules (scanner/languages.py) covering Python, JavaScript, TypeScript, Go, Java, and PHP. Clean files are bypassed instantly; only suspicious snippets with surrounding context are packaged for AI review.
Stage 3: Multi-Role Reasoning with Google Gemma 2
Candidate snippets are dispatched to Google Gemma 2 (analyzer/ai_client.py). Specialized auditor personas analyze each flaw:
-
Injection Auditor: Traces whether untrusted inputs flow into
sqlite3.execute(),child_process.exec(), oreval(). - Credential & Secret Detector: Distinguishes between real high-entropy API tokens and harmless test dummy strings.
-
Access & Cryptographic Reviewer: Flags weak hashing (
MD5,SHA1), disabled TLS validation, and unsafe deserialization (pickle.loads, unsafe YAML).
Stage 4: Live Threat Grounding via SerpApi
When Gemma 2 confirms a vulnerability, SecureScope queries SerpApi (analyzer/cve_search.py) against the National Vulnerability Database (NVD) and MITRE CWE:
search_query = f"{vulnerability} {language} (site:cve.mitre.org OR site:nvd.nist.gov)"
This attaches verified CVE IDs, severity scores, and direct research links to every report.
Stage 5: Software Composition Analysis (SCA) via Google OSV
Over 80% of real-world vulnerabilities stem from third-party dependencies. SecureScope parses requirements.txt and package.json, querying Google's Open Source Vulnerabilities (OSV) API to detect known CVEs, exact line numbers, and recommended patched version numbers (>= x.y.z).
Stage 6: Automated Remediation Engine
SecureScope doesn't just detect vulnerabilitiesโit fixes them. Using remediator/patcher.py, developers can generate a unified Git diff (securescope.patch) or apply safe automated fixes directly to source files with .bak safety backups.
๐ธ The Multi-Modal Reporting Experience
SecureScope delivers findings across four complementary output channels:
- Rich Terminal Dashboard: Color-coded severity gauges, OWASP Top 10 breakdown tables, and highlighted code snippets.
- Interactive Standalone HTML Report: Zero-dependency dark-mode dashboard with expandable vulnerability cards, fix suggestions, and clickable CVE badges.
- OASIS SARIF 2.1.0 Export: Direct ingestion into GitHub Advanced Security and GitHub Code Scanning alerts.
-
ElevenLabs Audio Security Briefing: Synthesizes an executive spoken overview (
.mp3) summarizing critical risks for engineering leads on the go.
๐ Real-Time Web Dashboard (--serve)
For developers who prefer an interactive visual interface, SecureScope includes a built-in, zero-dependency local web server:
python cli.py --serve
Running this command spins up a local dashboard at http://localhost:8080 where you can:
- Trigger live audits across any directory path.
- Filter findings by Severity (Critical, High, Medium, Low) and instant text search.
- Click "Download Git Patch" to grab a ready-to-commit
.patchfile. - Click "Auto-Fix Files" to remediate code directly with automatic safety backups.
๐ฌ Real-World Example: Finding & Fixing an Injection Flaw
To test the system, I ran SecureScope against a deliberately vulnerable fixture containing an unsafe SQL query:
Vulnerable Input Code (app.py):
def search_users(username):
conn = sqlite3.connect("users.db")
cursor = conn.cursor()
# Flaw: Direct string interpolation into SQL query
cursor.execute(f"SELECT * FROM users WHERE name = '{username}'")
return cursor.fetchall()
SecureScope Terminal Output:
โญโโโโโโโโโโโโโโโโ #1 โ SQL Injection via String Formatting โโโโโโโโโโโโโโโโโฎ
โ Severity: ๐ด CRITICAL โ
โ OWASP: A03:2021 โ Injection โ
โ Confidence: HIGH โ
โ File: app.py (line 45) โ
โ โ
โ Description: User-controlled 'username' parameter is directly formatted โ
โ into the SQL query string, allowing arbitrary SQL command execution. โ
โ โ
โ ๐ก Fix: Use parameterized queries: โ
โ cursor.execute("SELECT * FROM users WHERE name = ?", (username,)) โ
โ โ
โ ๐ Live CVE: CWE-89 (https://cwe.mitre.org/data/definitions/89.html) โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
Auto-Remediation with Unified Patching:
Running python cli.py --patch generates a clean Git patch:
--- a/app.py
+++ b/app.py
@@ -45,1 +45,1 @@
- cursor.execute(f"SELECT * FROM users WHERE name = '{username}'")
+ cursor.execute("SELECT * FROM users WHERE name = ?", (username,))
Apply with git apply securescope.patch or pass --fix to patch the file automatically!
Generated ElevenLabs Voice Briefing Transcript:
"Attention security team. This is your SecureScope automated security audit briefing. We scanned 2 files in 0.1 seconds, identifying 1 critical vulnerability: SQL Injection via String Formatting in app.py. AI-suggested parameterized query patches have been compiled in your HTML report."
๐ช Zero-Config Git Pre-Commit Hook
Prevent vulnerable code and leaked secrets from ever reaching your Git history with a single command:
# Install the hook into your current Git repository:
python cli.py --install-hook
# Now git commit automatically screens your staged diff in <0.2s:
git commit -m "feat: user search"
# ๐ [SecureScope] Auditing staged code and dependencies before commit...
# ๐จ [SecureScope] Commit rejected: Security issues detected in staged changes!
# โข Run 'python cli.py --diff' to view full findings.
# โข Run 'python cli.py --fix' to automatically apply remediations.
โก Quickstart & How to Run
1. Installation
git clone https://github.com/SuperSaiyan101/securescope.git
cd securescope
pip install -r requirements.txt
2. Instant Local Scan (No API Key Required)
python cli.py --path ./tests/fixtures/vulnerable_app --skip-ai --output all
3. Full AI Scan with Google Gemma 2
export GROQ_API_KEY="gsk_..." # Windows: $env:GROQ_API_KEY="gsk_..."
python cli.py --path ./my-project --output all
4. 100% Offline Local Scan with Ollama
ollama pull gemma2
python cli.py --path ./my-project --provider ollama --model gemma2 --output all
5. Generate Voice Briefing with ElevenLabs
export ELEVENLABS_API_KEY="your_key"
python cli.py --path ./my-project --voice --output all
6. Auto-Remediation & Patching
# Generate unified git diff patch:
python cli.py --path ./my-project --patch
# Or auto-fix source files with safety backups (.bak):
python cli.py --path ./my-project --fix
7. Launch Real-Time Web Dashboard
python cli.py --serve
# Open http://localhost:8080 in your browser
๐ CI/CD Integration: GitHub Actions & SARIF Code Scanning
SecureScope includes a drop-in workflow (.github/workflows/securescope.yml) that audits every pull request, exports SARIF 2.1.0 results into the native GitHub Security Tab, and blocks merges on critical flaws:
name: SecureScope Security Scan
on: [push, pull_request]
permissions:
contents: read
security-events: write
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: '3.12'
- run: pip install -r requirements.txt
- name: Run SecureScope Audit
env:
GROQ_API_KEY: ${{ secrets.GROQ_API_KEY }}
run: python cli.py --path . --output all --report-file securescope_report --fail-on critical
- name: Upload SARIF to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: securescope_report.sarif
continue-on-error: true
๐ ๏ธ How I Built It (Show Your Work)
This project was developed iteratively using OpenCode, an open-source terminal coding agent harness connecting to open-weight LLMs.
Using OpenCode, I:
- Architected the hybrid engine: Combined regex pre-filtering with Google Gemma 2 for speed and precision.
- Standardized on Open Formats: Implemented OASIS SARIF 2.1.0 to integrate seamlessly with GitHub Advanced Security.
-
Engineered Auto-Remediation: Built a unified diff patch generator and direct AST file patcher with automatic
.bakbackups. -
Integrated Supply Chain Auditing: Connected directly to the Google OSV API to inspect
requirements.txtandpackage.jsonwith zero API keys. - Crafted Developer Guards: Designed a one-click Git pre-commit hook and a zero-dependency local web server for visual security audits.
Building an open security tool using an open agent harness felt like the ultimate demonstration of what open-source AI makes possible in 2026.
๐ Code & Repository
- GitHub Repository: https://github.com/SuperSaiyan101/securescope
- License: MIT License
What are your biggest pain points with modern code security scanners? Try running SecureScope on your project, and share your thoughts and feedback below!
Top comments (0)