Raksa

Secure code changes, backed by evidence.

Raksa is an AI security engineer for developers. It connects vulnerability analysis, targeted remediation, verification, and human review in a single workflow—helping teams move from a potential security issue to a change they can inspect before it reaches their codebase.

From finding to reviewed fix

1. Find
Connect a GitHub repository and analyze a bounded source snapshot for potential SQL injection in Python code.

2. Fix
Raksa uses NVIDIA Nemotron through Nebius Token Factory to propose a focused remediation based on the affected code.

3. Validate
The proposed change is checked against the original source context and constrained to the intended replacement, reducing the risk of applying a stale or unrelated edit.

4. Verify
Raksa rechecks the patched code and can run tests through a configured isolated sandbox. The workflow distinguishes a failed or unavailable check from a successful result.

5. Review and approve
Inspect the patch and its verification evidence, then explicitly approve creation of a Draft GitHub pull request. Raksa does not push directly to the default branch and checks that the analyzed revision has not changed before opening the PR.

Why Raksa

A security finding is only the start of remediation. Developers also need a focused fix, evidence that the original issue has been addressed, confidence that normal behavior still works, and control over when a change is proposed to the team. Raksa brings those steps together while keeping generated code reviewable and approval in human hands.

Technology

• NVIDIA Nemotron + Nebius Token Factory — AI-assisted remediation
• Python + FastAPI — analysis and workflow orchestration
• React + TypeScript + Vite — developer dashboard
• GitHub App — repository access and pull-request workflow
• Tavily — optional security research
• Docker / Nebius Sandbox — configurable isolated execution for verification

Demonstration

The included SQL injection demonstration uses a controlled SQLite example to show how a string-built query can return unintended rows and how parameterized SQL blocks the same payload. Repository analysis currently targets potential SQL injection in Python source. Findings and generated patches remain subject to verification and developer review; a passing check is evidence, not a guarantee of application-wide security.

Explore the project

Source code, setup instructions, and the demo: https://github.com/omkz/raksa

Built With

• docker
• fastapi
• github-app
• nebius-token-factory
• nvidia-nemotron
• python
• react
• tavily
• typescript
• vite