Sentinel-AI: Hybrid Security Auditor

Zero-leakage hybrid security engine vaulting credentials on the edge while leveraging Google Gemini & Meta Muse Spark 1.3 deep reasoning.

Comment

💡 Inspiration

Enterprise engineering teams face a critical dilemma: developers want AI-driven code auditing, automated vulnerability remediation, and compliance verification, but strict corporate security policies and regulatory frameworks (SOC 2 CC6.1, GDPR Article 32, HIPAA) strictly forbid sending proprietary code, database connection strings, JWTs, or private API keys to external cloud LLMs.

Existing solutions either:

  1. Force everything to the cloud (risking severe credential leaks, intellectual property exposure, and regulatory fines).
  2. Rely entirely on small local models (lacking the multi-step semantic reasoning required to fix complex SQL injection, command execution, and deep architectural flaws).

We built Sentinel-AI to resolve this compromise through a breakthrough Offline-First Hybrid Architecture: the edge guarantees unbreakable privacy, while the cloud delivers world-class deep multi-model reasoning.

⚙️ What It Does

Sentinel-AI partitions code auditing into a three-tiered pipeline:

  1. Tier 1: Local Edge Cryptographic Vaulting (100% On-Device)

    • Parses the local file AST and scans for sensitive material (Private Keys, OpenAI/Google API keys, database connection strings with passwords, JWTs).
    • Generates deterministic, irreversible SHA-256 cryptographic placeholders (e.g., __SENTINEL_API_KEY_a3f89b1c__).
    • Vaults original values strictly in volatile local memory.
    • Runs local deterministic checks for simple bugs (e.g. prototype pollution) in < 5ms with zero cloud egress.

  2. Zero-Knowledge Airgap Boundary

    • Before any network call is dispatched, an automated assertion engine mathematically verifies that zero plain-text secrets exist in the payload (100% Zero-Leakage Guarantee).

  3. Tier 2: Dual-Cloud Deep Reasoning Tier

    • Transmits only the de-identified, sanitized AST structure to the cloud.
    • Leverages Google Firebase AI Logic (Gemini) and Meta Muse Spark 1.3 (utilizing over 1,400 reasoning tokens per issue).
    • Generates formal CVSS 3.1 Base Scores, maps compliance controls (SOC 2 CC6.1/CC6.6, GDPR Art. 32), and synthesizes parameterized, drop-in remediation diffs.
    • Features a Multi-LLM Consensus Ensemble Mode where Gemini and Muse Spark cross-verify patches to prevent hallucinated syntax errors.

  4. Tier 3: Local In-Memory Re-hydration & Verification

    • The client receives the sanitized diff and re-hydrates the original secrets from local memory into the final code patch.
    • The completed fix is verified locally without any secrets ever touching cloud servers.

🛠️ How We Built It

  • Edge Engine: Built with TypeScript and Node.js standard libraries (node:crypto, node:fs, node:https) for maximum performance, minimal attack surface, and $0.00 cloud compute overhead.
  • Cloud AI Intelligence:
    • Google Firebase AI Logic & Gemini: Structured output extraction and semantic vulnerability mapping.
    • Meta Muse Spark 1.3: Direct integration with the Meta Model API (https://api.meta.ai/v1/chat/completions), leveraging deep chain-of-thought reasoning tokens for vulnerability analysis.
  • Interactive Web Studio: Built with zero external dependencies in HTML5/CSS3/JavaScript, deployed live on GitHub Pages.
  • Testing & Quality: 11 automated unit and integration tests across 5 test suites (npm test) guaranteeing regression-free operation.

🥊 Challenges We Overcame

  1. Preventing Regex Statefulness Leaks: When checking code across multiple passes, global regex instances (/g) retain stateful lastIndex pointers, causing intermittent verification failures. We engineered stateless regex factories to ensure deterministic verification.
  2. Handling Dynamic Replacement Placeholders: In JavaScript String.prototype.replace(), tokens like $1 reference regex capture groups. We implemented safe escaping ($$1) to ensure SQL parameterized queries are generated faithfully without syntax corruption.
  3. Managing Deep Reasoning Token Budgets: Meta Muse Spark 1.3 utilizes extensive reasoning tokens (1,200–1,500 tokens) to analyze complex vulnerabilities before producing output. We dynamically calibrated token allocation so that the model has full room for deep thought while outputting strictly compliant JSON schemas.

🏅 Accomplishments We're Proud Of

  • 100% Zero-Leakage Egress: Not a single API key, password, or proprietary token ever reaches the cloud.
  • Production-Grade Live Studio: A responsive, live Web Studio that demonstrates the vaulting and remediation workflow in real-time.
  • Dual-Cloud Support: Successfully uniting Google's Hybrid AI paradigm with Meta's cutting-edge Muse Spark 1.3 reasoning model.
  • Zero Cloud Compute Overhead: Runs completely on local development machines with $0.00 in cloud compute costs.

🔮 What's Next for Sentinel-AI

  • Pre-Commit Git Hooks & GitHub Actions: Automatic CI/CD blocking when un-sanitized code attempts to push.
  • VS Code / IDE Extension: Real-time inline ghost-text remediation with local vault badges.
  • Infrastructure-as-Code (IaC) Support: Expanding secret vaulting to Terraform, Kubernetes manifests, and Dockerfiles.

Built With

Share this project:

Updates

Submission history