CyberMentor

AI security mentor that teaches developers to write safe code — by making them exploit real vulnerabilities first, guided by Claude AI

Comment

Inspiration

84% of software vulnerabilities live in application code (Veracode 2024). Security education is broken — developers sit through compliance videos, forget everything by next sprint, and keep shipping the same bugs. Junior developers who need security mentorship the most almost never get it.

We asked: what if learning security felt like a game? What if instead of being told what SQL injection is, you had to actually exploit it?

What it does

CyberMentor is an AI-powered interactive security learning platform. You're given real vulnerable code patterns drawn from CVEs and OWASP Top 10. Your job is to exploit the vulnerability first — feel the danger — then fix it.

  • 15 challenges across OWASP Top 10 (SQL injection, XSS, IDOR, broken auth, and more)
  • Progressive hint system — get unstuck without spoiling the learning moment
  • AI mentor review — submit your fix and get line-by-line feedback powered by Claude
  • Open-ended chat — ask your AI mentor anything, anytime
  • Progress tracking — streaks, completion %, challenge categories

Every interaction is Socratic: CyberMentor guides you to discover why vulnerable patterns are dangerous.

How we built it

Backend: FastAPI (Python 3.12) with structured endpoints for challenges, hint progression, solution validation, and AI chat. Claude claude-haiku-4-5-20251001 powers the AI mentor with a Socratic system prompt that never gives away answers directly.

Frontend: Self-contained React 18 SPA (CDN, no build step) with a terminal-style code editor, animated hint reveals, and a chat panel.

AI Design: Two Claude call types — structured solution evaluation (JSON schema with correctness score + per-line feedback) and open-ended mentoring chat with OWASP category context.

Challenges we ran into

Getting Claude to be a good teacher — not just an answer machine — required extensive prompt engineering. The breakthrough was an explicit Socratic constraint: Claude must ask a guiding question before giving any direct answer.

Validating free-form code fixes is hard. We solved it with two-pass evaluation: first check if the vulnerability pattern is gone, then assess code quality.

Accomplishments we're proud of

The three-level hint system took many iterations to get right. When it works, users genuinely feel the "aha" moment of discovering the exploit themselves — that's the whole point.

What we learned

Security education is most effective when it's experiential. The combination of challenge-first + AI mentor creates a feedback loop that traditional courses can't replicate.

What's next for CyberMentor

  • Expand to 50+ challenges covering all OWASP Top 10 with real CVE examples
  • Add multiplayer "CTF mode" where teams compete on timed challenges
  • GitHub integration — analyze your own PRs for OWASP vulnerabilities
  • Certification track with verifiable completion credentials

Built With

Share this project:

Updates