ReleaseFence is officially submitted to GitLab Transcend: Life After Code 2026!
What started as an idea for detecting malicious npm dependencies has become a working security prototype integrated with GitLab.
The principle is simple: every commit deserves a security check, even when no dependencies have changed.
Here's what we've achieved:
- Built an automatic commit scanner that inventories currently resolved npm dependencies and checks new JavaScript/TypeScript code.
- Integrated GitLab Duo Red and Blue agents for adversarial security analysis.
- Demonstrated a real merge request automatically triggering the Duo workflow.
- Successfully detected and blocked a synthetic compromised dependency in GitLab CI.
- Demonstrated a separate AI-assisted dependency repair, followed by independent verification of the resulting commit.
- Published the source code, test evidence, and live demonstration.
The biggest challenge was establishing trust between AI agents, code changes, and release decisions. An AI agent claiming something is fixed isn't sufficient. The fix needs independent verification.
What's next? Completing the automatic Red/Blue repair-and-retest loop, integrating live threat intelligence into every-commit scanning, and connecting protected release authorization.
The fully autonomous workflow isn't finished yet, but the existing security checks, GitLab Duo execution, and release blocking are real.
Watch the demo: https://www.youtube.com/watch?v=6p-9TT0cRxA
Explore ReleaseFence: https://gitlab-ai-hackathon.gitlab.io/transcend-october-2026/7929991/showcase/
Source code: https://gitlab.com/valh4x/releasefence-engineering
Proof before release.
Log in or sign up for Devpost to join the conversation.