CodeAudit Agent

Running
Dashboard

Inspiration

Professional security audits cost $500 to $5000, which puts them out of reach for indie developers, students, and small teams. Meanwhile, the bugs that cause real breaches are often embarrassingly simple: a hardcoded password, a SQL query built from user input, an os.system call nobody questioned. We wanted a tool that finds those bugs in seconds, explains them with evidence, and fixes them, for free.

What it does

CodeAudit Agent takes any public GitHub repository URL and returns a security report: every finding with the exact file, line, and code snippet that proves it, plus a 0 to 10 risk score for the whole repo. Then, for any finding, NVIDIA Nemotron 3 Ultra proposes a real code patch, and the patch is verified by applying it to a temporary copy of the code and re-scanning. You see the risk score before and after, so you know the fix actually worked instead of trusting the AI's word for it.

How we built it

The backend is FastAPI in Python. Detection is fully deterministic: we parse the code into an abstract syntax tree and run hand-written detectors, including two-step taint tracking for SQL injection, where user input flows into a query across two hops. No LLM guessing in detection. The AI layer runs on Nebius Token Factory using NVIDIA Nemotron 3 Ultra, and it only proposes fixes. The frontend is a React dashboard: paste a URL, watch the scan, browse findings grouped by severity, and click "Get AI fix" on anything.

Challenges we ran into

Almost all of them were configuration, not code. Our first backend never read its .env file at all, so the AI layer silently stayed off. Then the model id we guessed returned a 404, and the docs link we had was dead, so we queried the live model catalog from our own API key and copied the exact id. Then the reasoning model returned empty responses, because reasoning models sometimes answer in a different response field and need a larger token budget to finish thinking. Each fix made the error message more honest, until the whole chain finally worked end to end.

Accomplishments that we're proud of

A complete loop that actually runs: scan, evidence, score, AI-proposed fix, deterministic verification, before and after risk. On real open-source repositories it surfaced dozens of findings, including a real hardcoded credential, and every proposed patch is checked by re-scanning rather than taken on faith.

What we learned

Detection should be deterministic and verification should be mechanical. The LLM is best used for the one thing it is good at: proposing a fix. We also learned that the boring parts, environment loading, exact model ids, response shapes, are what break live demos, and that honest error messages are worth more than clever code.