Transcend Security Guard

Inspiration

Inspiration

Security teams face a major challenge after code is written: detecting vulnerabilities is only the beginning. Developers must understand findings, decide how to fix them, and verify that changes are safe.

We created Transcend Security Guard to demonstrate how GitLab Duo Agent Platform can support this process while keeping humans in control.

What it does

Transcend Security Guard demonstrates an AI-assisted DevSecOps workflow that combines automated security scanning, AI-generated remediation proposals, human approval, and continuous verification.

The project uses intentionally vulnerable Python examples with fake data to demonstrate security detection and remediation safely.

How we built it

We developed a Python security scanner and integrated it with GitLab CI/CD, automated unit tests, and GitLab SAST powered by Semgrep.

Our demonstration followed these steps:

1. Created isolated, intentionally vulnerable Python examples.
2. Detected 8 security findings: 4 High and 4 Medium.
3. Used a GitLab Duo Agent Platform Developer flow to propose a parameterized-query fix for SQL injection.
4. Reviewed and approved the proposed remediation.
5. Applied the fix through GitLab Duo Chat on a separate branch.
6. Re-ran the security pipeline and verified the results.

Accomplishments

• Successfully detected 8 security findings.
• Resolved the targeted SQL injection finding (B608).
• Reduced the findings from 8 to 7.
• Passed all 20 automated unit tests.
• Successfully executed security_scan, unit_tests, and semgrep-sast.
• Preserved human approval for repository changes.
• Kept the intentionally vulnerable demonstration isolated from the main branch.

Challenges

We encountered GitLab service interruptions, agent-session delays, and challenges distinguishing built-in scanner coverage from advanced SAST findings.

We overcame these issues through isolated branches, verified pipeline results, careful approvals, and repeated testing.

What we learned

AI-assisted security remediation works best when automated suggestions are independently reviewed and validated.

We also learned that a successful CI pipeline does not necessarily mean that the code is free of vulnerabilities.

What's next

We plan to expand detection coverage, improve AI-assisted vulnerability triage, introduce structured remediation reviews, and develop a more comprehensive human-in-the-loop DevSecOps workflow.

Transcend Security Guard is currently a working technical demonstration rather than a production-ready security platform.

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Transcend Security Guard

Built With

• agent
• ci/cd
• duo
• gitlab
• python
• sast
• semgrep
• unittest
• yaml