Inspiration When people build a website, they focus on how it looks and works and forget about the hidden risks in the code, like passwords and API keys left in git history (where deleting them doesn't remove them) and outdated libraries with known vulnerabilities, so we built a tool that checks for both against CVE databases before anything ships and also cuts what it costs to send that code to AI tools.
What it does
You paste a public GitHub link, and Code Rail finds exposed secrets (including deleted ones still in history), flags outdated or vulnerable libraries by checking them against CVE databases, and shows a trimmed, secret-free copy of the code with estimated token savings.
How we built it We built a Python and Render backend in Docker that runs Gitleaks for secrets, OSV-Scanner to check dependencies against known-vulnerability (CVE) databases, and our own detectors, paired with a single-page site and 3D animation that shows results as the scan runs.
Challenges we ran into Our biggest challenges were cutting false alarms, finding secrets that were deleted but still in history, checking libraries for vulnerabilities only when a lockfile exists, connecting a frontend and backend that were built separately, and keeping the tool honest about what it can and can't check.
Accomplishments that we're proud of We're proud that it runs end to end on real repositories, catches deleted secrets and vulnerable libraries in one scan, and openly lists what it did not check.
What we learned We learned that website security covers more than passwords, since deleted secrets stay in git history until the key is revoked and outdated libraries ship known vulnerabilities, and that a security tool earns trust by showing its limits.
What's next for Code Rail Next we will try to partner up with many different AI companies which makes it so that they will use our application while testing repositories. We also plan to move from just repositories to full website analysis.
Built With
- claude
- codex
- github
- render
- vercel
Log in or sign up for Devpost to join the conversation.