DEV Community

Yash Selokar
Yash Selokar

Posted on

SecureVibeCoded (svc): The AI-Powered Secret Scanner Developers Would Actually Pay For

#devchallenge #hf26challenge #opensource #security

Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle Submission 💸

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

SecureVibeCoded (svc) is an intelligent, change-aware secret scanner that sits on top of Gitleaks as a pre-commit hook. It's the tool that actually blocks leaked API keys before they hit GitHub — and if one slips through, it tells you exactly how to recover.

Who would pay for this? Any developer, freelancer, or startup that has ever accidentally pushed a Stripe key, AWS credential, or GitHub token to a public repo. The average cost of a cloud breach from an exposed credential is \$4.45 million (IBM, 2023). svc is the \'\$0 firewall\' that runs on your laptop.

Think of it as: Gitleaks (raw pattern engine) + Logistic Regression brain + Google Gemma semantic auditor — all offline, all open-source.

Demo

🌐 Live Web Portal: https://hacktoberfest-commit-shield-git-main-yash-selokars-projects.vercel.app

💻 GitHub Repo: https://github.com/yashselokar2025/Hacktoberfest-CommitShield

The web portal features:

  • An animated terminal hero showing a real git commit being blocked in 0.2 seconds
  • An interactive browser playground where you can type svc scan, svc model, svc install live
  • A Decision Matrix showing 3 real scenarios: REAL key → BLOCKED, test fixture → PASSED (zero false alarm)
  • A AI Threat Vector tab covering post-exposure recovery

Code

GitHub logo yashselokar2025 / Hacktoberfest-CommitShield

SecureVibeCoded (svc) 🛡️

Live link -https://hacktoberfest-commit-shield-git-main-yash-selokars-projects.vercel.app

An evidence-based, change-aware security gate for Git repositories powered by calibrated Logistic Regression & Google Gemma.

CI License: MIT Python 3.9+ Next.js 16 Google Gemma

SecureVibeCoded (svc) operates as an intelligent pre-commit post-processor on Gitleaks. It eliminates developer alert fatigue by distinguishing NEW vs. EXISTING findings, estimating true Bayesian probabilities via Logistic Regression, and leveraging Google Gemma (open-weights LLM) for semantic context audits and instant remediation code suggestions.

Includes a modern Next.js web showcase and distribution portal ready for immediate deployment on Vercel.

🌐 Web Showcase & Vercel Deployment

SecureVibeCoded includes an animated terminal marketing frontend and interactive browser playground in the web/ directory:

  • Animated Terminal Hero: Showcases git commit blocking secrets in real-time.
  • One-Click Install Scripts: Hosted API routes for /api/install.sh (Linux/macOS) and /api/install.ps1 (Windows).
  • In-Browser Playground: Interactive terminal simulator supporting svc --help, svc scan, svc model, svc install.
  • Interactive Config Builder…
View on GitHub

Install & try it in 2 commands:

pip install git+https://github.com/yashselokar2025/Hacktoberfest-CommitShield.git
svc install   # Hooks into your repo's pre-commit
Enter fullscreen mode Exit fullscreen mode

How I Built It

The stack is entirely open-source AI at every layer:

Layer 1 — Gitleaks (Open-Source Rule Engine)

Gitleaks scans git diff --cached (only newly staged lines, not the whole repo) against 150+ battle-tested regex patterns. This is the detection engine.

Layer 2 — 7-Signal Logistic Regression (F1 = 0.950)

Every Gitleaks match passes through a calibrated classifier that computes 7 features:

Signal Why it matters
Charset-bounded Shannon Entropy Hex vs Base64 patterns have different entropy profiles
Known Provider Prefixes sk_live_, ghp_, AKIA are near-certain real keys
Sensitive File Risk .env, .pem, .key paths score higher
Variable Assignment Context api_key = is riskier than expected_token =
Comment Penalty Secrets in comments are often documentation examples
Test File Penalty test_, _spec, fixture paths reduce score
Placeholder Penalty dummy, your_token_here, example strings reduce score

This model achieves F1 = 0.950, reducing false positives from the raw Gitleaks baseline of ~58% down to ~8%. You can inspect the weights live:

svc model
Enter fullscreen mode Exit fullscreen mode

Layer 3 — Google Gemma Semantic Auditor (The Real Innovation)

For borderline tokens, svc invokes Google Gemma (open-weight LLM) to read the surrounding function scope, AST context, and variable semantics:

# From commitshield/model/gemma_auditor.py
GEMMA_AUDIT_PROMPT = """
You are Gemma, an elite security auditor examining Git diffs.
File: {file_path} | Rule: {rule_id}
Code context:
\"\"\"
{context_snippet}
\"\"\"
Is this token a REAL credential or a FALSE POSITIVE (test fixture, placeholder)?
Respond in JSON: {{ \"is_real_secret\": true/false, \"confidence\": 0-1, \"reasoning\": "...", \"remediation\": "..." }}
"""
Enter fullscreen mode Exit fullscreen mode

Gemma runs 100% offline via Ollama — your proprietary source code never leaves your machine:

ollama run gemma2:2b   # Downloads once, runs forever offline
svc scan               # Gemma now audits all borderline findings
Enter fullscreen mode Exit fullscreen mode

If Ollama isn't installed, svc automatically falls back to a built-in rule-guided offline engine — zero crashes, zero cloud dependency.

Layer 4 — Change-Aware SQLite Baseline

Normal scanners dump all 20 existing warnings on every commit. svc maintains a local SQLite database of findings and only surfaces newly introduced secrets:

✅ NEW finding → Terminal alert + commit blocked
📝 EXISTING finding → Silently logged to baseline (no alert fatigue)
✔️ RESOLVED finding → Marked as fixed in the database
Enter fullscreen mode Exit fullscreen mode

Layer 5 — Two-Layer GitHub Actions Shield

  • Layer 1 (Local): Pre-commit hook blocks secrets before they leave the developer's machine
  • Layer 2 (Remote): If someone bypasses with --no-verify, GitHub Actions CI blocks the PR merge button

Why Does Open Innovation Matter?

This is where closed alternatives completely fail:

1. Privacy — Your code stays on your machine
Every closed secret scanning SaaS (GitGuardian, Snyk) uploads your code to their servers for analysis. For a freelancer working with a client's financial data or proprietary algorithms, that's a non-starter. With svc + Ollama + Gemma, zero bytes of your source code ever leave your laptop.

2. Cost — \$0 vs \$XXX/month
GitGuardian charges ~\$29/developer/month. For a solo freelancer or 5-person startup, that's \$1,740/year just to not leak secrets. svc costs nothing. The open-weight Gemma model downloads once and runs forever.

3. Customizability — Tune it for your stack
Closed tools can't be fine-tuned for niche technology stacks. svc's Logistic Regression weights are exposed and overridable. Working with a custom internal secret format? Add a Gitleaks rule and retrain the classifier in 10 minutes.

4. No Vendor Lock-in
TruffleHog does live API verification — but what happens when their service goes down during your late-night deploy? svc works offline, always, everywhere. Airplane mode? Pre-commit still fires. Corporate firewall? No problem.

5. Gemma vs GPT-4 — The Right Tool for the Job
Gemma 2B is specifically designed for code understanding and runs in ~180ms on a modern CPU. GPT-4 would cost ~\$0.03 per secret checked, which adds up to dollars per working session. Gemma: \$0.00, every time.

How It Compares to Existing Tools

Feature Gitleaks TruffleHog SecureVibeCoded
Change-aware baseline ❌ ❌ ✅ SQLite delta tracking
False positive rate ~58% ~40% ~8% (F1=0.950)
Works 100% offline ✅ ❌ (API calls) ✅ Ollama + fallback
AI semantic context ❌ ❌ ✅ Google Gemma
Remediation advice ❌ ❌ ✅ .env code suggestions
Alert fatigue prevention ❌ ❌ ✅ NEW vs EXISTING delta
Cost Free Free Free

Prize Categories

  • Best Use of Gemma — Google Gemma open-weight model is the core AI layer for semantic context auditing, running 100% locally via Ollama
  • Overall Prize — Automatically eligible

Top comments (0)