CodeSentinel

💡 Inspiration Modern software development moves fast, but manual security code reviews often act as a bottleneck. While static application security testing (SAST) tools exist, many traditional tools generate overwhelming false positives or lack the context to explain why a snippet is vulnerable and how to fix it safely. We were inspired to build CodeSentinel to bridge this gap: an AI-driven security assistant that doesn't just flag unsafe C/C++ memory patterns (like CWE-401 memory leaks or CWE-120 buffer overflows), but actively acts as an intelligent pair programmer by generating refactored, production-ready replacement code.

🛠️ How We Built It CodeSentinel was architected around speed, deterministic security reporting, and developer accessibility:

Frontend (Streamlit): Created an intuitive, lightweight web interface allowing developers to paste C/C++ source code and trigger security reviews on demand.

Agent Core (google-genai SDK & Gemini): Powered by Google's gemini-3.8-flash model endpoint, we engineered tight system instructions to enforce static security analysis rules.

Optimization Pipeline: Configured low-temperature constraints (temperature=0.2) and output token limits (max_output_tokens=600) to keep response latency low and prevent server timeouts, ensuring rapid feedback for developers.

🚧 Challenges We Faced API Rate Limits & Latency: During development, we encountered capacity spikes (503 capacity errors) and long processing delays when generating verbose explanations. We resolved this by fine-tuning the GenerateContentConfig parameter settings, capping output tokens, and tightening system instructions to deliver concise, high-value Markdown outputs without sacrificing diagnostic quality.

SDK Migration & Model Alignment: Navigating deprecated API endpoints required updating our core pipeline to the latest google-genai SDK and ensuring seamless alias compatibility between our analysis core (agent.py) and UI wrapper (app.py).

🎓 What We Learned Deterministic AI Design: Guardrails, low temperature settings, and explicit system instructions are essential when building security-critical AI tools where halluncinated code fixes cannot be tolerated.

Agent Performance Tuning: Optimizing prompt structure and model parameters directly impacts user experience—reducing response latency from minutes down to a few seconds.

Hands-On LLM Orchestration: Gained deep experience integrating the official google-genai SDK and structuring multi-layer agentic workflows for software analysis.

Built With

• gemini-api-(google-genai)
• python
• streamlit