This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine
What I Built
Demo
Code
How I Built It
<!--GhostKey is a Node.js 22 application with a dependency-free browser interface.
Its collection pipeline reads selected files, Git patches, and ZIP members. Deterministic detector rules identify credential candidates before any AI analysis takes place.
flowchart LR
Files[Selected files] --> Rules[Credential detectors]
Git[Local Git history] --> Rules
ZIP[ZIP members] --> Rules
Shell[Selected shell history] --> Rules
Rules --> Mask[Mask values and generate HMAC IDs]
Mask --> Correlate[Correlate recorded copies]
Correlate --> AI[Local MiniLM analysis]
AI --> UI[Trace map, timeline, and remediation]
UI --> Export[Masked Markdown or JSON]For local AI, GhostKey uses:
- Xenova/all-MiniLM-L6-v2
- Transformers.js
- ONNX Runtime
- Quantized CPU inference The model only receives masked context. It embeds that context and compares it with three review scenarios:
- Production or authentication usage
- Examples and test fixtures
- Credentials retained in logs or backups These results are advisory semantic similarities—not credential-validity checks or calibrated probabilities. AI never suppresses a deterministic finding or changes its severity.
GhostKey also supports optional local explanations from Gemma 3 1B through Ollama. Only masked evidence is sent to the loopback Ollama endpoint.
The security model includes:
- Binding only to 127.0.0.1
- Host and Origin validation
- Session tokens for scan APIs
- Read-only scanning
- Masked findings and exports
- Per-scan HMAC keys discarded after scanning
- In-memory results cleared when the server restarts
- No hosted inference service The repository currently passes all 12 automated tests, including Git-history recovery, cross-source correlation, ZIP safety limits, masking, UTF-16 shell history, and local API security boundaries.-->
Top comments (0)