Compliacnce Autopilot

Industry page
Scan Page
Dashboard
PR in github Page
Continent and Country
Fix issues
Github Repository
Architecture diagram

Inspiration

As a law student, I understand that many developers and startups don't have the time or knowledge of the many compliance rules they have to follow, specific to the country, region, and industry they are in. This leads to compliance and legal issues. Manual checks also miss real problems in real code. We wanted a tool that reads real laws, finds real gaps in real code, and then writes a real fix for each gap, which makes it faster, cheaper, and easier to scale through regulatory checks. This is going for the Autopilot Agent track.

What it does

Compliance Autopilot scans a GitHub repository. It checks the code against real regulations from real government sources, such as GDPR, PSD2, and BaFin. The tool finds compliance gaps in the code. It shows the exact file and line for each gap. The tool then writes a real code fix for each gap, not just a text plan. A user can review each fix before it ships. A user can also send the fix straight to GitHub as a pull request. The tool can also watch a repository over time and open a new pull request automatically after each new scan.

How we built it

We built the backend with Python and FastAPI. We built the frontend with React and Vite. We store scan data in SQLite. We use Qwen models through Alibaba Cloud for the AI work. The system runs on multiple agents. One agent parses the regulation text. One agent reads the codebase. One agent finds the compliance gaps. One agent writes the remediation plan and the code fix. We deployed the app on an Alibaba Cloud ECS server. We use Docker to run the backend and the frontend together.

Challenges we ran into

We found and fixed several real bugs during testing against real repositories:

Some compliance gaps point to more than one file. Our first version checked only one file per gap. We fixed the code to check every listed file. On Windows, old git files blocked new repository clones. We fixed the clone process to clear these files first. Our GitHub token did not reach the backend container in production. The Docker Compose file did not pass the token through. We fixed the Docker Compose file. Cloned repositories did not survive a container restart. The clone folder was not on the persistent disk. We moved the clone folder to the persistent volume. A fine-grained GitHub token needs explicit access to each target repository. We had to grant this access before pull request creation would work.

Accomplishments that we're proud of

We tested the tool on real open-source projects, not only demo code. Examples are NodeGoat, Vulpy, Ghostfolio, and Navidrome. The tool found real compliance gaps in these real projects. It wrote real code fixes for these gaps. It opened real pull requests on GitHub. A human can review each fix before it goes live, or let the tool open the pull request immediately.

What we learned

Real code is messy. Real code does not match simple demo examples. We learned to test with real repositories early. Early testing found bugs that demo data could not find. We also learned that deployment configuration needs the same care as application code. A single missing environment variable can silently break a feature that local tests do not catch.

What's next for Compliance Autopilot

We want to add more regulations and more countries. We want to support more programming languages for automatic code fixes, such as PHP, C#, and Ruby. We want to add automatic tests for each generated fix, to check that it does not break the build. We want to let a team define its own custom compliance rules.