Inspiration
Software security tools such as Semgrep are excellent at detecting vulnerabilities, but detection is only the beginning of the remediation process. Developers still need to understand the vulnerability, locate the root cause, implement a secure fix, and verify that the vulnerability has been properly addressed.
We wanted to bridge this gap.
The inspiration behind VeriFAI LLM was to create an AI-powered security engineer capable of taking a vulnerability detected by Semgrep and helping transform that finding into an appropriate security patch. Instead of simply telling developers that their code is vulnerable, VeriFAI LLM aims to help them understand why it is vulnerable, how it can be fixed, and whether the fix actually works.
Our vision is simple:
Detect → Understand → Patch → Verify.
What it does
VeriFAI LLM is an AI-powered vulnerability remediation system that combines Semgrep static analysis with a trained AI model to automatically assist with security patch generation.
The system analyzes a source-code project and uses Semgrep to identify potential security vulnerabilities. The detected findings are then provided to the AI model along with relevant source-code context.
VeriFAI LLM analyzes the vulnerability and generates a remediation tailored to the affected code.
The workflow is:
Source Code → Semgrep → Vulnerability Detection → AI Analysis → Patch Generation → Verification
Rather than providing only a security recommendation, VeriFAI LLM attempts to produce an actual code-level remediation that developers can review, apply, and validate.
The goal is to reduce the gap between finding a vulnerability and fixing it.
How we built it
VeriFAI LLM was designed as a modular security-AI pipeline.
At the core of the system is Semgrep, which performs static analysis and identifies vulnerabilities in the target source code.
The findings are then processed by our AI remediation layer. The model receives information about the vulnerability together with the relevant code context and is instructed to reason about the root cause and generate an appropriate patch.
The application architecture consists of:
- Streamlit — interactive user interface
- FastAPI — backend API and orchestration layer
- Semgrep — static application security testing and vulnerability detection
- AI/LLM remediation engine — vulnerability analysis and patch generation
- Python — core application and security automation
We designed the system so that the AI is not simply asked to rewrite code. It is given a security finding and contextual information so that the generated remediation is directly connected to the vulnerability detected by the security scanner.
Challenges we ran into
One of our biggest challenges was making AI-generated patches security-aware rather than simply syntactically correct.
Generating code is relatively easy for an LLM. Generating a patch that actually addresses the underlying security problem without introducing another vulnerability is much more difficult.
We encountered several challenges:
- Providing sufficient source-code context to the AI.
- Translating static-analysis findings into meaningful AI instructions.
- Generating patches that preserve the original application's functionality.
- Avoiding patches that fix one issue while introducing another.
- Connecting automated vulnerability detection with AI remediation.
- Designing a verification process for generated patches.
- Making the system practical enough to run as an automated security workflow.
These challenges reinforced an important lesson: AI-generated security fixes need validation and should not be blindly trusted.
Accomplishments that we're proud of
We are proud of building a working bridge between static security analysis and AI-powered remediation.
Instead of stopping at a vulnerability report, VeriFAI LLM attempts to continue the security workflow toward an actionable solution.
Some of the accomplishments we are particularly proud of include:
- Integrating Semgrep into an AI-driven remediation workflow.
- Building an architecture that connects security scanning, AI reasoning, and patch generation.
- Developing an interactive interface for security analysis.
- Automating the transformation of vulnerability findings into proposed code patches.
- Designing the system around a Detect → Understand → Patch → Verify methodology.
- Building the project with practical developer and cybersecurity workflows in mind.
Most importantly, VeriFAI LLM represents our attempt to move from AI that explains vulnerabilities toward AI that actively helps remediate them.
What we learned
Building VeriFAI LLM taught us that cybersecurity automation requires much more than simply connecting an LLM to a security scanner.
We learned that context is critical. An AI model needs to understand the vulnerable code, the surrounding logic, the type of vulnerability, and the intended remediation before it can generate a useful patch.
We also learned that AI-generated code should be treated as a proposed remediation rather than unquestionable truth.
This led us to focus heavily on verification and security validation.
The project also taught us how to combine different technologies—static analysis, APIs, AI models, backend services, and interactive interfaces—into a single security automation pipeline.
Most importantly, we learned that the strongest security AI systems are not those that simply generate impressive answers, but those that can take action while providing mechanisms to validate that action.
What's next for VeriFAI LLM
VeriFAI LLM is still evolving.
Our next objective is to make the system increasingly autonomous while maintaining strong security controls around AI-generated modifications.
Future development will focus on:
- Automated patch application directly to the target repository.
- Automatic re-scanning with Semgrep after remediation.
- Patch validation and regression testing.
- Support for more programming languages and vulnerability classes.
- Improved vulnerability-context extraction.
- Better patch-generation accuracy through specialized security training.
- GitHub/GitLab repository integration.
- Detailed security reports showing the vulnerability, reasoning, patch, and verification results.
- A feedback loop that learns from successful and unsuccessful remediation attempts.
Ultimately, our goal is to transform VeriFAI LLM from an AI-assisted patch generator into a fully autonomous AI security engineer capable of continuously analyzing, remediating, and verifying vulnerabilities throughout the software development lifecycle.
Our long-term vision is simple:
Don't just detect the vulnerability. Understand it. Fix it. Verify it.
Built With
- fastapi
- llm
- python
- qwen2.5coder32b
- semgrepcli
- streamlit
