DevSecGuard AI

• 

  Key features: AI code analysis, secret scanning, risk classification and CI/CD compliance that runs automatically on every push.

• 

  Live scan: agent.py ranks findings as Critical, High or Medium and blocks the push until secrets are removed.

• 

  Live scan: agent.py ranks findings as Critical, High or Medium and blocks the push until secrets are removed.

• 

  Architecture: GitHub push protection and Actions feed the agent.py engine, which outputs a pass/fail CI/CD gate.

• 

• 

  Built by Sherafgan Zafar with Python, Groq, Llama and GitHub Actions. No hardcoded secrets in the code.

Inspiration

Every developer has heard the horror stories: an API key accidentally pushed to GitHub, a hardcoded password sitting in a repo for months, a vulnerability discovered only after it was exploited. Security checks usually happen too late, or not at all. We wanted a guardrail that works at the moment code is written and pushed, not weeks later during an audit. That idea became DevSecGuard AI.

What it does

DevSecGuard AI is an AI-powered DevSecOps assistant that secures code repositories in real time. It:

• Scans codebases with LLMs to find security flaws and logical vulnerabilities
• Detects hardcoded secrets such as Stripe API keys and tokens, locally and inside CI/CD pipelines
• Classifies risk severity (Critical, High, Medium) so teams know what to fix first
• Enforces continuous compliance by running automatically on every push through GitHub Actions

How we built it

• Python powers the core scanning engine (agent.py)
• Groq API with Llama models analyze the code quickly and report vulnerabilities
• GitHub Actions (security_scan.yml) runs the security scan on every push
• GitHub secret scanning and push protection stop accidental credential leaks
• A helper script (list_nvidia_models.py) manages the available models
• Developed and tested on Linux / WSL (Ubuntu)

Challenges we ran into

• Securely managing API keys: all secrets were purged from active branches and moved to environment variables
• Getting the LLM to return consistent, useful severity ratings instead of vague answers
• Integrating the scan into the CI/CD pipeline so that it runs automatically without slowing developers down

Accomplishments that we're proud of

• A working end-to-end pipeline: code push → automated AI scan → risk report
• Zero hardcoded secrets in the final repository
• Real-time, automated compliance with no manual steps

What we learned

• How DevSecOps shifts security "left", into the earliest stages of development
• Practical prompt design for getting structured results from LLMs
• How to build and secure GitHub Actions workflows

What's next for DevSecGuard AI

• Support for more languages and scanning of whole repositories
• Automatic fix suggestions and pull request comments
• A dashboard with security trends and reports
• More model options and integrations with other CI/CD platforms

Links

• GitHub: https://github.com/sherafganzafar/devsecguard-ai

Built With

• ai
• bash
• cybersecurity
• devsecops
• git
• github-actions
• groq
• linux
• llama3
• llm
• python