GitSentry: Stateful AI SecOps & Code Review Agent

GitSentry Landing Page
Live GitHub PR #1 (Approved Exemption)
The Firestore Memory Bank
Live GitHub PR #2 (Autonomous Merge Block)
Dashboard
Architecture

Inspiration

In the era of "vibe coding" and autonomous AI coding assistants (like Cursor and GitHub Copilot), software teams are writing and shipping code 10x faster than ever before. However, the code review and security toolchain hasn't caught up.

Traditional linters and static AI PR review bots suffer from a critical flaw: they are completely stateless and amnesic. They review every Pull Request in a vacuum with zero organizational memory.

If a security team approves a legitimate exemption for an unauthenticated health probe on staging, the bot forgets it 5 minutes later and blocks the PR again.
They dump repetitive, generic comments with no context, causing massive alert fatigue.
They point out flaws but cannot autonomously fix what they flag.

We built GitSentry to transform code security from a noisy, blocking bottleneck into an autonomous, collaborative AI partner with persistent architectural memory.

What it does

GitSentry is a stateful AI SecOps & Code Review Agent that lives inside GitHub Pull Requests and actively pairs with developers to secure their codebase:

⚡ Hybrid Two-Tier Gemini 3.7 Flash Triage (<200ms): Ingests incoming PR webhooks in sub-50ms via Google Cloud Run, runs sub-second low-latency risk classification, and reserves high-thinking deep reasoning for complex AST security audits.
🧠 Persistent Memory Bank (Google Cloud Firestore): Remembers approved architectural decisions (e.g., DEC-89: Staging VPC exemption) across PR lifecycles, ensuring the agent never re-flags previously approved exceptions.
💬 Multi-Turn Socratic PR Negotiation: When developers request an exemption in PR comments (@gitsentry), the agent evaluates the justification. If the reason is weak, it pushes back with clarifying questions; if valid, it logs the decision to Firestore and clears the merge gate to 🟢 SUCCESS.
📊 Developer Habit Profiling: Maintains behavioral habit vectors per developer (e.g., tracking recurring raw SQL queries), providing personalized coaching instead of generic noise.
🛠️ Autonomous Remediation PRs: When high-severity vulnerabilities are found, GitSentry doesn't just block the merge — it autonomously writes verified patch diffs, creates a fix branch, and opens a ready-to-merge remediation PR.
🎨 Bauhaus SecOps Workbench: A real-time, interactive Next.js dashboard deployed on Vercel that visualizes live webhook streams, execution pipelines, and Firestore memory records.

How we built it

GitSentry is engineered 100% serverless on the Google Cloud Platform and Google AI Stack:

Google Gemini 3.7 Flash (via Google GenAI SDK): Powers our two-tier reasoning engine — fast triage classification (<200ms) and deep Socratic multi-turn dialogue.
Google Cloud Run: Autoscaling, containerized FastAPI webhook receiver that verifies GitHub HMAC-SHA256 signatures with sub-50ms latency.
Google Cloud Pub/Sub: Decouples incoming webhook bursts and manages reliable asynchronous worker queues (pr-events).
Google Cloud Firestore: Serves as our persistent Memory Bank, storing versioned architectural decisions, developer habit vectors, and compliance audit logs with automatic exponential-decay compaction.
Google Secret Manager: Enforces zero-trust isolation for GitHub App RSA private keys, webhook secrets, and Gemini API keys.
Next.js & Tailwind CSS: High-performance Bauhaus-inspired frontend with live polling and state visualization.

Challenges we ran into

Zero-Latency HMAC & RS256 Cryptography: Stripping Windows-induced CRLF padding from Secret Manager strings to ensure 100% cryptographic precision when minting GitHub App JWTs (RS256) and verifying webhook HMAC-SHA256 signatures.
Context Bloat & Memory Compaction: Designing an exponential-decay compaction algorithm in Firestore so historical decisions and habit profiles fit concisely inside Gemini 3.7 Flash context prompts without bloat.
Bidirectional GitHub Synchronization: Ensuring that GitHub Commit Status checks (gitsentry/security), PR comment replies, and remediation branch creations execute reliably and idempotently under high event concurrency.

Accomplishments that we're proud of

True Cross-PR Memory in Action: Successfully proving that an exemption granted on PR #1 (staging /health) is remembered and strictly enforced against PR #2 (production /health violation) without human intervention.
100% Serverless & Live: Fully deployed on Google Cloud Run and Vercel with real-time bidirectional GitHub App integration.
Sub-200ms Triage: Achieving lightning-fast security classification with Gemini 3.7 Flash before engaging deeper reasoning tiers.
Aesthetic Bauhaus Workbench: Creating an intuitive, high-contrast visual dashboard that brings transparency to AI agent decision-making.

What we learned

The immense power of Gemini 3.7 Flash's hybrid thinking modes — utilizing low thinking for immediate gatekeeping and deep thinking for Socratic dialogue and patch synthesis.
How combining a stateless LLM with a persistent Firestore memory graph fundamentally shifts AI from an annoying linter into a trusted collaborative teammate.
Designing decoupled serverless event architectures with Google Cloud Pub/Sub and Cloud Run to withstand enterprise webhook throughput.

What's next for GitSentry

Multi-Repo Knowledge Federation: Sharing architectural decisions and security policies across entire GitHub organizations and monorepos.
Autonomous SOC 2 / ISO 27001 Compliance Reporting: Exporting Firestore architectural decisions and audit logs directly into audit-ready compliance evidence.
IDE Co-Pilot Sidecar (VS Code Extension): Bringing GitSentry's developer habit coaching directly into the editor before code is even committed.