CodeShield-AI

CodeShield AI is an AI-powered code security scanner that analyzes GitHub/GitLab repositories, detects vulnerabilities with static analysis LLMs, and generates fixes, reports, and patches in seconds.

Comment 1

Inspiration

Every day, thousands of open-source and enterprise repositories unknowingly ship vulnerable code. Traditional static analyzers produce overwhelming reports, while AI code assistants often generate fixes without explaining the underlying security risks. We wanted to bridge that gap by building an intelligent security platform that not only detects vulnerabilities but also explains them, prioritizes their severity, and generates actionable, patch-ready fixes. Our goal was to make application security accessible to every developer, regardless of security expertise.

What it does

CodeShield AI is an AI-powered repository security analyzer that scans GitHub, GitLab, local projects, or ZIP uploads to identify security vulnerabilities using a hybrid approach combining static analysis and Large Language Models.

The platform automatically:

Clones and analyzes repositories Detects security vulnerabilities Performs semantic AI security reviews Generates secure code remediations Creates unified Git patches Produces downloadable reports in SARIF, HTML, Markdown, JSON, CSV, and PDF Maintains scan progress even after server restarts Provides an interactive dashboard for reviewing findings

Instead of simply flagging issues, CodeShield AI helps developers understand why vulnerabilities exist and how to fix them.

How we built it

We built CodeShield AI using a modern AI-first architecture.

Backend

Python FastAPI Background Pipeline Manager Disk-backed Scan State Manager

AI Layer

Groq API Llama 3.3 70B Semantic vulnerability analysis AI-generated remediation

Code Analysis

GitPython Repository parser Static regex engine Intelligent code chunking Prompt optimization

Frontend

Interactive web dashboard Syntax-highlighted vulnerability viewer Side-by-side code comparison

Infrastructure

Docker Docker Compose GitHub Actions GitHub Container Registry

A custom chunk-merging algorithm groups compatible files together, significantly reducing API calls while maximizing LLM context utilization, allowing large repositories to be analyzed in seconds.

Challenges we ran into

One of our biggest challenges was analyzing large repositories within LLM context limits.

Initially, repositories generated hundreds of API requests, causing rate limits and slow scans. We solved this by designing a smart chunk-merging strategy that combines compatible code into optimized prompts while preserving context.

Other challenges included:

Handling repositories with thousands of files Maintaining scan state after server crashes Keeping AI responses consistent Generating accurate unified Git patches Balancing scan speed with detection quality Supporting multiple repository sources Accomplishments that we're proud of Built a complete end-to-end AI security platform from scratch. Reduced LLM API calls dramatically using intelligent code chunking. Achieved repository scans in under 10 seconds for many projects. Implemented persistent scan recovery across server restarts. Generated AI-powered secure code fixes with downloadable Git patches. Supported multiple report formats including SARIF for CI/CD integration. Created an intuitive dashboard for developers to review vulnerabilities. What we learned

This project taught us that effective AI security tools require much more than simply sending code to an LLM.

We learned how to:

Design scalable AI pipelines Optimize prompts for long codebases Balance static analysis with semantic reasoning Build resilient background processing systems Generate reliable automated code fixes Create developer-friendly security workflows

Most importantly, we learned that combining deterministic security rules with AI reasoning produces significantly better results than relying on either approach alone.

What's next for CodeShield-AI

Our roadmap includes making CodeShield AI a complete DevSecOps platform.

Planned features include:

Private repository scanning Pull Request security reviews GitHub App integration Semgrep integration CVE and dependency intelligence Secret detection OWASP Top 10 mapping Multi-language support Team workspaces Slack, Discord, and Microsoft Teams notifications CI/CD plugins for GitHub Actions, GitLab CI, Jenkins, and Azure DevOps AI-powered security risk scoring Historical vulnerability tracking Enterprise dashboards and compliance reporting

Our vision is to help developers identify and fix security vulnerabilities before they ever reach production, making secure software development faster, simpler, and more accessible.

Built With

Share this project:

Updates