VulnHunter AI

Inspiration

Security vulnerabilities are everywhere, but finding them requires specialized knowledge, expensive tooling, and hours of setup. Every developer deserves access to professional-grade security analysis — not just those at companies with dedicated AppSec teams. I built VulnHunter AI to make OWASP Top 10 scanning as simple as pasting a URL.

What It Does

VulnHunter AI scans any public GitHub repository for security vulnerabilities in under 30 seconds. You enter a GitHub repo URL, VulnHunter fetches the source code via the GitHub Trees API, runs it through Claude AI with a tightly-constrained OWASP Top 10 system prompt, and returns a structured vulnerability report with:

• Risk score (0–100) with severity label (CRITICAL / HIGH / MEDIUM / LOW / CLEAN)
• Per-finding details: vulnerable code snippet, OWASP category, CWE ID, and recommended fix
• OWASP heatmap showing which of the Top 10 categories were hit
• Severity filtering to triage findings from critical down to informational

How I Built It

Backend (FastAPI + Python 3.12): The core engine is a VulnScanner class that fetches up to 40 files from a GitHub repo (prioritized by recency), skips noise like node_modules, minified JS, and lockfiles, then analyzes files in parallel batches of 8 using Claude Haiku. Each analysis call returns a JSON array of findings matching a strict schema: OWASP category, severity, title, description, vulnerable snippet, fix recommendation, and CWE ID. A second Claude call synthesizes everything into a 3-sentence executive summary.

Frontend (React 18 SPA): A self-contained index.html served by FastAPI — no build step required. Uses async polling (GET /api/scan/{id}/status) to display live progress while the scan runs, then renders the full report with filterable findings cards and an OWASP category heatmap.

Risk Scoring: min(100, Σ weights) where CRITICAL=40, HIGH=20, MEDIUM=8, LOW=3, INFO=1 per finding. Simple, transparent, and calibrated to match industry severity standards.

Challenges

The hardest challenge was getting Claude to return consistently parseable JSON across all file types. A Python script, a Dockerfile, and a YAML config require very different security lenses — but they all need to produce the same output schema. The solution was an extremely precise system prompt that includes the exact JSON schema, explicit field constraints, and zero-tolerance for explanatory text outside the array.

Managing GitHub API rate limits was another challenge — especially for large monorepos. The solution was capping at 40 files and using the Trees API's recursive mode to select the most recently modified files, ensuring the scan hits the code that actually matters.

What I Learned

• How to design AI prompts for structured output reliability at scale
• The importance of parallel batching — analyzing 8 files concurrently reduced scan time from 4+ minutes to under 30 seconds for typical repos
• Async polling patterns in FastAPI with background tasks
• How the OWASP Top 10 2021 maps to real code patterns across 12+ languages

What's Next

• Private repo support via OAuth GitHub integration
• CI/CD GitHub Action to block PRs when critical vulnerabilities are detected
• Trend tracking to show security posture improving over time
• Fix generation — not just highlighting the vulnerability, but generating the patched code

Built With

• anthropic
• docker
• fastapi
• python
• react