VulnLens AI

Inspiration

Modern applications can contain security vulnerabilities that are difficult to understand from a simple scanner alert. Developers may know that a vulnerability exists, but still struggle to see how untrusted input reaches the dangerous operation, why it matters, and how to fix it safely.

We built VulnLens AI to make vulnerability analysis more understandable and actionable. The goal was to combine reliable, deterministic security analysis with AI assistance without allowing AI to become the source of truth.

What We Built

VulnLens AI is a security scanner that detects vulnerabilities and traces relevant source-to-sink data flows. It supports vulnerability detection across areas such as SQL/NoSQL injection, command injection, path traversal, file handling, and secret exposure.

The scanner produces structured evidence including the source, propagation path, sink, severity, confidence, and vulnerable code context. Findings can be baseline-aware, exported as SARIF, and integrated into CI security gates.

Our AI Security Copilot works on top of this deterministic evidence. It explains the vulnerability, potential impact, attack scenario, and remediation, while providing a secure code example. The AI does not determine the vulnerability's severity or evidence; it explains what the scanner has already established.

How We Built It

We developed the project with Node.js and JavaScript, using AST-based static analysis, targeted data-flow analysis, baseline-aware scanning, SARIF reporting, and a web-based security investigation cockpit. The AI Copilot uses an external LLM provider through OpenRouter, with validation and safe fallback behavior.

Challenges

One of our biggest challenges was reducing false positives while still detecting realistic data-flow patterns. We added regression tests, security fixtures, corpus validation, baseline integrity checks, and CI verification to make the scanner more reliable.

What We Learned

Building VulnLens AI taught us that effective AI security tooling should not simply replace deterministic analysis. A better approach is to combine trustworthy evidence with AI reasoning—letting the scanner find the risk and AI help humans understand and fix it.