DevGuard Nigeria

Autonomous AI agent that reviews every code push for OWASP vulnerabilities and NDPR compliance violations, blocks unsafe deployments, and creates GitLab issues — triggered by one command.

Comment

Inspiration

I am a Statistician at a Nigerian teaching hospital. Every day I work with sensitive patient data — BVN records, phone numbers, medical histories — handled by software built under enormous time pressure by developers who have no security background and no security budget.

I have watched Nigerian fintech apps ship with hardcoded API keys. I have seen health platforms log patient phone numbers to console. I have reviewed systems that transmit BVN data over plain HTTP. Not because the developers are careless — but because they are building alone, moving fast, and have no one to catch these mistakes before they reach production.

Nigeria's Data Protection Regulation has been law since 2019. Most Nigerian developers have never heard of it. There is no tool that checks for NDPR violations automatically. There is no affordable security review for a startup with five people and no budget.

DevGuard Nigeria exists because I am tired of watching preventable data breaches happen to people who trusted Nigerian software with their most sensitive information. Every Nigerian deserves software that was reviewed before it shipped. Every startup deserves a security engineer — even if they cannot afford one.

That is what DevGuard is. A 24/7 AI security engineer for every Nigerian startup that cannot afford one.

The Problem

Nigeria has over 3,000 tech startups. Most have no dedicated security engineer. A single SQL injection in a fintech app can expose millions of users' financial data. A hardcoded API key can drain a company's bank account overnight. Developers are shipping fast and hoping for the best — they deploy and pray.

As a Statistician at a Nigerian teaching hospital with years of experience handling sensitive health data, I see this problem daily. Nigerian developers are building real products for real people, with no safety net.

What DevGuard Nigeria Does

DevGuard Nigeria is an autonomous AI DevSecOps agent that gives every Nigerian startup a 24/7 security engineer — for free.

A developer types one command:

"Review MR number 1 and deploy if safe"

The agent autonomously executes 6 tool calls with zero human intervention:

  1. Fetches the merge request diff via GitLab MCP
  2. Scans the code for OWASP Top 10 vulnerabilities AND Nigerian NDPR compliance violations
  3. Creates labelled GitLab issues for every finding (CRITICAL / HIGH / MEDIUM)
  4. Blocks the CI/CD pipeline if any critical or high risk is found
  5. Posts a reasoning trace comment on the merge request explaining exactly why deployment was stopped
  6. Approves and triggers deployment only when code is clean

What Makes It Unique

DevGuard is the first AI security agent built specifically for the Nigerian developer ecosystem. It detects not just OWASP Top 10 vulnerabilities but also violations of Nigeria's Data Protection Regulation (NDPR) — including:

  • BVN and NIN exposure (NDPR Article 2.1)
  • PII logged insecurely (NDPR Section 2.1)
  • Customer data transmitted over HTTP
  • Phone number handling without consent (NDPR Article 2.2)
  • Paystack and Flutterwave payment logic changes flagged for review

No other submission in this hackathon can write an NDPR citation. I can — because I work in Nigerian healthcare data every day.

How I Built It

Google Cloud ADK (Agent Development Kit) powers the Gemini brain that orchestrates all six tool calls autonomously.

GitLab Duo Agent Platform + GitLab MCP Server gives the agent direct access to merge request diffs, issue creation, pipeline control, and MR comments — all through the official GitLab MCP integration.

FastAPI DevGuard Security Engine is a custom MCP-compatible API deployed on Render that runs the OWASP + NDPR pattern matching and generates plain-English reasoning traces.

Streamlit Frontend provides a web interface at devguard-frontend.onrender.com where any developer can paste code and get an instant scan.

GitLab CI/CD Pipeline runs three stages on every commit — test, security scan, and deploy. DevGuard scans its own code before it ships. The project protects itself.

Challenges I Faced

Google Gemini API quota restrictions — Nigerian IP addresses receive zero free tier quota on the Gemini API. I solved this using Windscribe VPN to access the API from a US endpoint, then integrated the solution cleanly into the deployment workflow.

GitLab MCP Beta limitations — The GitLab MCP server is still in beta. I debugged JSON-RPC integration issues and built a robust tool call sequence that handles API errors gracefully.

NDPR rule design — Translating Nigerian data protection law into regex detection patterns required genuine domain knowledge. I drew on my professional background in health information management to identify the specific data elements Nigerian developers most commonly mishandle.

What I Learned

Building DevGuard taught me how true agentic behavior differs from chatbot behavior. An agent does not just answer questions — it plans, executes, and takes real action in the world. Watching DevGuard autonomously create GitLab issues and block a pipeline from a single natural language command was the moment this clicked for me.

Impact

  • 3,000+ Nigerian tech startups with no dedicated security engineer
  • 50,000+ developers now have access to a free AI security review
  • 200M+ Nigerians whose data is handled by apps that can now be scanned for NDPR compliance
  • ₦0 cost to any startup using DevGuard

"Because your users deserve secure software."

Built With

  • fastapi
  • gemini-api
  • gitlab-mcp-server
  • google-cloud-adk
  • ndpr
  • owasp
  • python
  • render
  • streamlit
Share this project:

Updates

Submission history