I built a Mac AppSec tool where the AI never sees your whole repo

#security #macos #ai #privacy

Most AppSec tools assume one thing first: upload the repo.

That breaks for NDA client code, regulated workloads, or a policy that source does not leave the building. SaaS scanners want the tree. On-prem enterprise gear assumes you have a security department. A lot of solo founders and small teams sit in the gap.

I built InsurStaq, a private AI security engineer for your Mac, to sit in that gap.

Evidence first, AI second

The product is deliberately not "an LLM over the repo." Point it at a codebase and it:

Maps the application: routes, auth and frameworks.
Finds the real issues: injection, exposed secrets (Git history too), vulnerable dependencies and infrastructure-as-code risks.
Traces attack paths an attacker could actually reach, from the internet to the exact line, so real risks come first instead of a thousand warnings.
Explains and drafts a fix: InsurStaq's own security model, fine-tuned for security work and running on your Mac, works from that evidence.
You approve, then a rescan proves the path is gone.

The AI never gets your whole repository as context, and it never calls a hosted model.

Privacy by design

Zero bytes of source code leave your Mac.
Air-Gapped Mode switches networking off, and it still works.
A privacy ledger shows every network call the app makes.

What it is / is not

Is: local code scanning + attack-path tracing + fixes you approve + compliance readiness evidence for SOC 2, ISO 27001, PCI DSS and OWASP ASVS.
Is not: a penetration test. Not a certification. Framework coverage is uneven, and I'd rather hear what you need than overclaim.

Reports export to PDF, HTML, Markdown, JSON, SARIF and CSV, and the CLI can fail CI on critical findings.

DEV Community

I built a Mac AppSec tool where the AI never sees your whole repo

Evidence first, AI second

Privacy by design

What it is / is not

Links

Top comments (0)