Opensec Intelligence Pro: Proof-Driven Remediation

• 

• 

• 

• 

• 

• 

Inspiration

Finding a vulnerability is only the beginning of securing software. A scanner can flag a potential issue, and an AI coding agent can generate a patch, but neither action proves that the vulnerability has actually been eliminated.

We wanted to address the gap between detecting a vulnerability and demonstrating that a remediation works. This led us to extend OpenSec Intelligence into OpenSec Pro: Proof-Driven Remediation, an evidence-oriented security workflow that combines deterministic vulnerability detection, isolated verification, structured reporting, and GitLab CI/CD automation.

Our central principle is simple: a security fix should earn trust through verification, not merely through an AI-generated explanation.

What it does

OpenSec Pro extends an open-source security analysis engine into a structured security remediation workflow.

1. Deterministic security scanning

OpenSec analyzes the target code and produces structured vulnerability findings. These findings can be consumed by automation and inspected by developers, reducing dependence on unstructured, model-generated assessments.

2. Proof-driven remediation verification

The project includes an isolated verification harness built around a controlled SQL-injection demonstration. It copies the vulnerable fixture into a temporary environment, confirms the expected finding, applies a parameterized-query remediation, and runs the scanner again to check whether the finding remains.

This creates a reproducible before-and-after verification process without modifying a production application.

3. GitLab CI/CD integration

The GitLab pipeline automates dependency installation, build validation, linting, unit tests, security scanning, report generation, isolated proof verification, and package creation. It also includes gated deployment and post-deployment health-check stages.

The integrated pipeline has executed successfully in GitLab, with build, lint, security, proof-verification, and package-generation jobs passing alongside 148 tests.

4. GitLab Duo remediation workflow

OpenSec Pro includes a custom GitLab Duo Agent Platform flow configuration designed to investigate high- and critical-severity findings, prepare minimal patches on isolated branches, create merge requests, and use pipeline results to assess remediation.

The flow is designed to preserve human control over merging and to distinguish verified fixes from unresolved findings. Its full execution through a recorded GitLab Duo session remains a validation step.

5. Structured evidence and Live Lab

JSON findings and HTML reports make security results accessible to both automated jobs and human reviewers. A browser-accessible Live Lab provides an interface for running the scanner against the bundled demonstration application.

The intended outcome is a workflow in which security findings, remediation changes, verification results, and release decisions can be examined rather than blindly trusted.

How we built it

We extended the existing MIT-licensed OpenSec Intelligence project rather than replacing its security engine or rebuilding its core functionality from scratch.

The implementation uses Node.js and JavaScript, npm-based dependency management, the existing deterministic scanner, structured JSON output, HTML report generation, and isolated proof-verification scripts.

We added a GitLab CI/CD pipeline with distinct validation, testing, security-analysis, verification, and packaging stages. The workflow separates ordinary product tests from intentionally vulnerable fixtures, preventing expected demonstration findings from being confused with regressions in the security tool itself.

We also added a custom Duo remediation flow definition, project-level agent instructions, flow-validation tooling, and a Live Lab server. The design keeps remediation changes separate from protected branches and requires verification evidence before a fix is considered successful.

The adapted project was integrated into the provisioned GitLab Transcend Hackathon workspace. The changes were merged into the GitLab main branch, and three real GitLab pipelines completed successfully. The final verified pipeline includes the security scan, isolated proof/remediation checks, and package artifacts.

Challenges we ran into

Distinguishing detection from proof. A scanner finding and a successful build do not establish that a vulnerability has been fixed. We addressed this by testing against a controlled vulnerable fixture and checking the scanner's result again after remediation.

Keeping verification safe. Proof execution against untrusted code can introduce serious risks. We designed the demonstration around a disposable copy of a bundled fixture, without production credentials or a requirement for unrestricted network access.

Making automation reproducible. Security tooling can have environment-specific dependencies, and AI-assisted remediation should not make ordinary CI unreliable. We separated deterministic validation from model-dependent remediation and fixed an existing dependency-lockfile inconsistency so clean dependency installation succeeds.

Integrating with a real developer platform. Adding CI configuration is not equivalent to demonstrating an operational agent. The GitLab pipeline is verified, while registration, execution evidence for the custom Duo flow, and public deployment require separate platform-level validation.

Accomplishments that we're proud of

• Integrated OpenSec Pro into the GitLab Transcend Hackathon workspace and merged the implementation into main.
• Achieved three successful real GitLab pipelines, covering branch, merge-request, and final-main execution.
• Passed the build, lint, and test suites, including 148 tests.
• Automated deterministic security scanning and generation of JSON and HTML report artifacts.
• Added an isolated SQL-injection proof-and-remediation verification workflow.
• Added GitLab Duo remediation flow configuration, validation tooling, and security-focused project instructions.
• Preserved the original MIT-licensed project and its existing functionality while building the hackathon-specific extension.
• Created a browser-accessible Live Lab implementation designed to demonstrate actual scanner results against a controlled target.

These accomplishments establish the verified CI/CD and local verification foundation. A recorded Duo flow execution and a publicly deployed Live Lab are the remaining end-to-end validation milestones.

What we learned

We learned that useful security automation requires more than combining a scanner with a language model. Deterministic checks, controlled execution environments, structured artifacts, regression tests, and explicit failure states are essential for making automated remediation trustworthy.

We also learned to separate the generation of a patch from the verification of its security properties. A patch can compile and pass ordinary unit tests while leaving the original vulnerability unresolved.

Finally, integrating with a real DevSecOps platform requires evidence at several levels: application correctness, pipeline execution, agent orchestration, permissions, and deployment. Treating each as a separately verifiable component makes the overall system more reliable and easier to audit.

What's next for OpenSec Pro: Proof-Driven Remediation

Our next milestone is to validate the complete GitLab Duo remediation loop in the actual platform: trigger a flow, investigate a real controlled finding, prepare a patch, open a merge request, run the verification pipeline, and capture the final execution evidence.

We also plan to deploy the Live Lab publicly, connect its health checks to the delivery workflow, and expand the evidence model to include commit identifiers, remediation diffs, proof results, regression outcomes, and deployment status.

The longer-term direction is an increasingly autonomous security engineer that can move from vulnerability discovery to verified remediation and controlled release while maintaining explicit safety boundaries and human oversight.

Our goal is not simply to automate security fixes. It is to make the correctness of those fixes demonstrable.

Built With

• application-security
• devsecops
• gitlab
• gitlab-ci/cd
• gitlab-duo-agent-platform
• javascript
• json
• mcp
• node.js
• npm
• regression-testing
• security-automation
• vulnerability-scanning