DevCop

Inspiration

Small teams ship fast but rarely have a dedicated security function. When a scanner flags a vulnerability, a developer must manually investigate, reproduce, fix, and verify — interrupting delivery. I wanted to show how GitLab Duo agents and a structured evidence pipeline can close that gap automatically, with a human staying in control of the final decision.

What it does

DevCop is a supervised DevSecOps workflow. Automated SAST and DAST scanning runs on every push. GitLab Duo agents investigate findings and push hardened fixes. A Code Review Flow automatically reviews every new merge request. Scanner results are collected into a structured evidence artifact. A fail-closed deployment gate reads that artifact and requires an explicitly authorized human to approve before any deployment proceeds. AI agents are blocked from authorizing their own work.

How I built it

• FastAPI backend with hardened endpoints
• GitLab CI pipeline: test → package → sast → dast → evidence → deploy
• GitLab Duo Security Analyst analyzed the original vulnerability via Chat
• GitLab Duo Developer Flow sessions pushed the remediation and hardening code
• GitLab Duo Code Review Flow configured for automatic MR review
• Deployment gate in Python: allowlist, agent denylist, SHA binding, pipeline ID binding, type validation
• 179 tests covering every gate condition, evidence schema, and dashboard endpoint

Challenges

• Making the gate genuinely fail-closed without any bypass path
• Distinguishing automatic Code Review Flow invocation from manually triggered Developer Flow sessions
• Ensuring the evidence artifact SHA and pipeline ID consistency checks work correctly across pipeline runs

What I learned

Supervised autonomy is more useful than full automation. The agents do the investigation and fix work. The gate enforces the policy. The human makes the final call. Each layer has a clear, verifiable role.

Built With

• ci/cd
• duo
• fastapi
• gitlab
• owasp
• python
• semgrep
• zap