HackForge

HackForge helps fast moving teams find real security issues, fix them, and verify that their projects are safer before they ship.

Comment

Inspiration

Hackathons move fast. Teams are focused on building features, integrating APIs, deploying, debugging, and preparing a demo before the deadline. Security can easily become an afterthought.

HackForge started from one question:

How can developers move quickly without accidentally shipping obvious security mistakes?

The goal is to give fast-moving teams a security checkpoint that is understandable, actionable, and designed for the hackathon development cycle.

What it does

HackForge is a security-first development workspace powered by CyberBot.

CyberBot follows a simple workflow:

Scan → Detect → Explain → Fix → Rescan → Verify

The security engine is designed to deterministically identify supported security problems such as:

  • exposed credentials and secrets
  • unsafe Git/environment-file practices
  • dependency risks
  • security configuration issues

HackForge then presents findings with severity, affected files, remediation guidance, and a security posture score.

After a developer fixes an issue, the project can be rescanned so HackForge can verify whether the finding is actually gone.

A core security principle

HackForge separates security detection from AI reasoning:

The deterministic scanner determines WHAT EXISTS. AI explains WHAT IT MEANS.

AI is not allowed to invent vulnerabilities, severity levels, or security scores.

Sensitive values are sanitized locally before any finding can be sent to an external AI service.

This keeps the security scanner useful even when AI is unavailable and reduces the risk of leaking the very credentials HackForge is trying to protect.

How we built it

HackForge is being built as a web application using:

  • Next.js
  • React
  • TypeScript
  • Tailwind CSS
  • Node.js
  • Git
  • GitHub
  • deterministic security scanning logic

The CyberBot architecture separates scanning, sanitization, scoring, remediation, and presentation so that each part can be independently tested.

The security posture score is deterministic rather than AI-generated. Findings receive predefined penalties based on severity, and successful remediation must be confirmed by a later scan.

Gemini is being integrated as a remediation assistant that receives only sanitized, verified findings and turns them into understandable security explanations and remediation guidance.

Challenges

One of the biggest challenges was deciding where AI should and should not be trusted.

Using an LLM to simply inspect code and decide whether something is vulnerable can create hallucinated findings. Instead, HackForge uses deterministic checks for detection and restricts AI to explaining findings that already exist.

Another challenge was handling sensitive information safely. A security scanner may discover API keys or credentials, so HackForge is designed to mask sensitive values before findings leave the scanner.

We also had to keep the scope realistic for a 24-hour hackathon. Instead of trying to build a full enterprise DevSecOps platform, the focus is a strong core workflow:

detect a real issue, explain it, fix it, rescan it, and prove improvement.

What we learned

Building HackForge reinforced that AI is most useful when it is given clear boundaries.

For cybersecurity, combining deterministic tools with AI can be safer and more useful than relying on AI alone.

We also learned that remediation is only half the job. A recommendation does not prove that a vulnerability was fixed. Verification through rescanning is an important part of the workflow.

Who it is for

HackForge is initially designed for:

  • hackathon participants
  • student developers
  • capstone teams
  • rapid-prototyping teams
  • developers without a dedicated security specialist

In the future, HackForge could also provide event-level security readiness tools for:

  • hackathon organizers
  • universities
  • coding bootcamps
  • enterprise innovation programs

What's next

Future directions include:

  • broader dependency scanning
  • more programming-language support
  • GitHub integration
  • CI/CD scanning
  • organization dashboards
  • historical security analytics
  • IDE integrations
  • richer remediation workflows

HackForge's goal is simple:

Build fast. Ship secure.

Built With

Share this project:

Updates

Submission history