DeployGuard AI

DeployGuard AI assesses repository readiness, detects security risks, applies controlled fixes, and verifies remediation with proven results—helping developers deploy safer software with confidence.

Comment

DeployGuard AI — Production Readiness, Backed by Evidence

Inspiration

AI-assisted development has made it easier than ever to build software. But writing code quickly does not mean that software is secure, reliable, or ready for production.

A repository may appear complete while hiding vulnerable dependencies, failing builds, missing tests, incompatible configurations, or deployment risks. For independent developers, startups, and small engineering teams, identifying and resolving these issues can be time-consuming.

This inspired DeployGuard AI, an intelligent production-readiness and controlled-remediation platform.

Our mission is simple:

Production readiness should be demonstrated through evidence, not assumptions.

Rather than building another AI assistant that merely recommends fixes, we wanted to create a system that performs real verification, explains the findings, applies supported fixes in controlled environments, and proves whether remediation succeeded.

What It Does

DeployGuard AI connects to GitHub repositories and combines deterministic engineering checks with NVIDIA-powered AI analysis to help developers understand and improve deployment readiness.

1. Repository Assessment

DeployGuard analyzes repository structure, dependencies, configuration, and available verification capabilities.

Using isolated Docker workspaces, it executes applicable checks such as:

  • Dependency security analysis
  • TypeScript verification
  • Linting and automated tests
  • Production builds
  • Environment and deployment configuration checks

The platform distinguishes between passed, failed, skipped, blocked, and inapplicable checks rather than treating missing verification as success.

2. Evidence-Based Readiness Scoring

DeployGuard calculates deterministic readiness scores from verified assessment results.

It also reports assessment coverage, allowing developers to understand both their readiness score and how much of the applicable criteria was actually evaluated.

3. NVIDIA Nemotron Intelligence

We integrated NVIDIA Nemotron 3 Super 120B A12B through Nebius Token Factory to interpret repository evidence, explain technical risks, provide architectural insights, and recommend improvements.

Importantly, AI recommendations do not override deterministic verification or independently authorize repository changes.

AI explains the findings. Engineering evidence determines the results.

4. Controlled and Verified Remediation

DeployGuard can apply supported dependency fixes inside disposable workspaces without modifying the original GitHub repository.

It then reruns security and applicable regression checks to determine whether the proposed fix actually worked.

Only successfully verified changes qualify as proven remediation.

5. Verified Patch Artifacts and GitHub Delivery

Successful remediation can produce a persisted, integrity-verified patch artifact containing the approved changes.

The GitHub delivery workflow uses repository identity, source-commit provenance, and explicit developer authorization to safely deliver verified changes.

Branch delivery and pull-request creation require separate confirmations, and DeployGuard does not automatically merge changes into the source branch.

How We Built It

DeployGuard AI was developed using Next.js 16, TypeScript, Node.js, Prisma, PostgreSQL, Docker, GitHub OAuth, GitHub App APIs, NVIDIA Nemotron, and Nebius Token Factory.

The architecture separates four responsibilities:

  1. Deterministic verification: Execute checks and collect evidence.
  2. AI reasoning: Interpret findings and recommend remediation.
  3. Controlled remediation: Apply supported fixes in isolated environments and verify the outcome.
  4. Authorized delivery: Persist verified artifacts and manage explicitly approved GitHub operations.

The application is deployed on an Oracle Cloud virtual machine using Nginx, systemd, and a production Next.js server.

Live application: https://deployguard.theconduitbox.com

Challenges We Faced

Building Trustworthy AI Verification

One of our greatest challenges was ensuring that AI-generated explanations never became substitutes for actual engineering verification.

We solved this by grounding readiness scoring in deterministic results and using Nemotron to interpret structured evidence.

Secure Sandbox Execution

Running checks against external repositories required careful isolation, controlled dependency installation, execution limits, and protection of the original source repository.

We developed Docker-based execution workflows to separate untrusted repository operations from the application.

Reliable AI Integration

During testing, AI requests sometimes experienced slow responses or timeouts.

We introduced structured responses, compact evidence payloads, request deadlines, and failure-tolerant handling so deterministic assessments could remain useful even when AI guidance was unavailable.

Remediation Provenance and GitHub Delivery

We encountered challenges preserving authenticated source identity across assessment, remediation, and GitHub delivery.

Rather than bypassing provenance checks, we improved source verification, persisted artifact metadata, and authorization safeguards.

We also discovered a branch compatibility issue when testing a repository using master instead of main. The workflow was updated to derive the correct branch from verified repository provenance.

Production Storage and Deployment

Deploying sandbox-based verification on a resource-constrained Oracle VM required careful dependency caching, disk management, Prisma client generation, and isolated release preparation.

These challenges taught us how to deploy and operate a working AI developer platform beyond a local development environment.

Accomplishments We're Proud Of

Our biggest achievement is demonstrating real vulnerability remediation backed by verifiable evidence, rather than simply producing AI-generated recommendations.

Verified Security Remediation

In a production assessment using a pinned vulnerable repository fixture, DeployGuard successfully demonstrated:

Metric Result
Initial readiness 67/100
Post-remediation readiness 100/100
High-severity vulnerabilities 1 → 0
Targeted dependency lodash
Trusted regression tests 4 passed
Modified files 2
Verified patch artifact Successfully persisted
Patch integrity SHA-256 verified

The platform persisted a verified 1,992-byte patch affecting package.json and package-lock.json, while leaving the original repository unchanged.

The readiness improvement reflects the evaluated checks and their coverage, not a claim that every possible production risk was eliminated.

Real GitHub Pull-Request Validation

We also validated the GitHub remediation-delivery workflow against an application repository.

That end-to-end test demonstrated an authenticated remediation branch push and a verified, open pull request.

Verified pull request: https://github.com/gevalinho/lih-wellcare-companion/pull/2

This demonstrated that DeployGuard can move beyond assessment and recommendation into controlled, developer-authorized remediation delivery.

A Working Production Platform

We successfully deployed DeployGuard AI with:

  • GitHub authentication and repository assessment
  • Isolated verification and security analysis
  • NVIDIA Nemotron-powered interpretation
  • Deterministic readiness scoring
  • Controlled remediation and security re-verification
  • Persisted verified patch artifacts
  • Explicitly authorized GitHub delivery workflows

What We Learned

Building DeployGuard AI reinforced several important lessons.

AI reasoning and engineering verification are different responsibilities. A convincing AI response is not proof that software is ready to deploy.

Security must be built into automation. Repository authorization, source provenance, artifact integrity, sandbox boundaries, and explicit approvals are essential when software can modify code.

Real-world testing reveals problems that unit tests cannot. GitHub authentication, branch differences, interrupted operations, and production resource constraints exposed issues that required architectural improvements.

Assessment coverage matters. A readiness score is more meaningful when developers can see which checks were actually evaluated.

Most importantly, we learned that trustworthy AI developer tools must combine intelligence with measurable, reproducible evidence.

What's Next

Our vision extends beyond the hackathon.

We plan to evolve DeployGuard AI into a production-readiness platform with persistent assessment history, expanded framework support, broader controlled remediation, CI/CD integration, and team collaboration.

We also envision a developer-focused public beta with usage controls, sustainable infrastructure, and eventually subscription plans for advanced remediation and collaboration features.

Our long-term goal is to make reliable software delivery more accessible to developers and engineering teams worldwide.

DeployGuard AI — Production readiness, backed by evidence.

Built With

Share this project:

Updates

Submission history