Inspiration
The cybersecurity landscape is evolving rapidly, with new vulnerabilities emerging daily. As developers, I have witnessed firsthand how security flaws can be overlooked during rapid development cycles. The OpenAI Build Week presented the perfect opportunity to address this challenge by leveraging GPT-5.6 and Codex to build an intelligent security assistant that does not just detect vulnerabilities but actively helps fix them.
The recent announcement of OpenAI's Daybreak initiative highlighted that patching vulnerabilities has become an even bigger challenge than discovering them. This inspired me to build a tool that bridges the gap between detection and remediation, empowering developers to secure their code efficiently. With over 20,000 new vulnerabilities discovered each year, I recognized the urgent need for an AI-powered solution that could democratize security expertise and make professional-grade vulnerability analysis accessible to every developer, regardless of their security background.
What it does
VulnShield AI is an intelligent security assistant that transforms how developers approach code security through three core functions.
First, it scans and detects vulnerabilities by analyzing source code for security issues including SQL Injection, Cross-Site Scripting (XSS), and Misconfiguration. It also scans web endpoints and URLs for common security weaknesses while identifying OWASP Top 10 vulnerabilities and detecting hardcoded secrets and credentials in code.
Second, it explains and educates by providing clear, non-technical explanations of each vulnerability, explaining the potential impact and exploitation vectors, and categorizing threats by severity level from Critical to Low. It includes real-world examples of how vulnerabilities can be exploited to help developers understand the risks.
Third, it fixes and protects by generating actionable remediation steps with code examples, suggesting secure coding practices to prevent future vulnerabilities, creating comprehensive security reports in HTML and JSON formats, and providing before and after code examples showing how to fix issues.
The tool is powered entirely by AI, using GPT-5.6 Sol for complex vulnerability analysis with maximum reasoning, GPT-5.6 Terra for balanced performance on routine scans, GPT-5.6 Luna for fast validation checks, and built entirely with Codex for rapid development.
How we built it
I designed VulnShield AI as a multi-agent system that leverages different OpenAI models for specialized tasks. The architecture included GPT-5.6 Sol for deep vulnerability analysis and complex reasoning at the xhigh level, GPT-5.6 Terra for code scanning and report generation at the medium level, and GPT-5.6 Luna for fast validation and repetitive tasks at the low level.
On Day 1, I focused on planning and core implementation. During the morning, I used GPT-5.6 Sol to architect the system design and define the vulnerability detection pipeline. I researched OWASP Top 10 vulnerabilities and created a detailed project roadmap. In the afternoon and evening, I built the core scanner using Codex with natural language prompts, integrated GPT-5.6 Sol for vulnerability analysis, developed the report generation module with GPT-5.6 Terra, and created the command-line interface for code and URL inputs. I tested on vulnerable code samples from OWASP WebGoat and iterated on prompt engineering for better results.
On Day 2, I focused on enhancement and polishing. During the morning, I added support for three vulnerability types: SQL Injection, XSS, and Misconfiguration. I implemented dynamic model routing between Sol, Terra, and Luna. I enhanced the report with severity scoring and remediation steps and added HTML report templates. In the afternoon, I added professional HTML report generation, created documentation including README and installation guide, recorded the demo video, and submitted to the OpenAI Build Week Challenge.
For the technical implementation, I used Codex to generate the core scanning logic. For example, I prompted Codex to write a Python function that scans code for SQL injection vulnerabilities, returning a list of dictionaries with line number, code snippet, severity, and description. I also used GPT-5.6 Sol with high reasoning to analyze vulnerabilities in depth, providing detailed explanations, potential impact assessments, complete code examples showing how to fix issues, and secure coding practices to prevent future occurrences.
Challenges we ran into
I encountered several significant challenges during development. The first was security classifiers blocking legitimate queries. GPT-5.6 has built-in safety classifiers that sometimes flagged legitimate security research queries as suspicious. I learned to craft prompts that clearly establish a security education context versus an exploit generation context, which allowed me to access the model's security knowledge without triggering safety filters. I solved this by carefully framing prompts in a security education context, which allowed me to access the model's security knowledge while staying within safety guidelines.
The second challenge was balancing performance versus accuracy. Using GPT-5.6 Sol with maximum reasoning at the xhigh level delivers the most accurate analysis but requires careful prompt engineering to stay within time constraints. I solved this by implementing dynamic model routing, routing simple queries to Luna, medium complexity to Terra, and complex security analysis to Sol.
The third challenge was the tight time constraints. Building a functional MVP in two days required ruthless prioritization. I focused on the most common vulnerability types and ensured the demo worked flawlessly rather than attempting to cover everything.
The fourth challenge was generating accurate remediation steps. Sometimes the model generated generic or incomplete fixes. I used few-shot prompting with examples of proper security fixes and verified all suggestions against OWASP guidelines to ensure accuracy.
Accomplishments That I'm Proud Of
I'm proud of building a functional MVP in just two days. The working security scanner can scan Python code for three vulnerability types including SQL Injection, XSS, and Misconfiguration, generate detailed reports with severity scores, and provide actionable remediation steps with code examples.
I successfully integrated three GPT-5.6 models including Sol, Terra, and Luna with dynamic routing for optimal performance. This demonstrates my ability to leverage the full power of OpenAI's new model family.
I created professional HTML reports that rival paid security tools, with executive summaries, vulnerability lists with severity badges, detailed explanations, and code examples for fixes.
My tool does not just find vulnerabilities but teaches developers about security best practices. This educational value is something I'm particularly proud of as it aligns with my goal of democratizing security expertise.
What We Learned
I gained valuable technical insights about AI models. Model specialization matters significantly, as using Sol for complex analysis and Terra for routine tasks improved both quality and efficiency. Reasoning levels matter, with xhigh on Sol producing deeper analysis but taking longer. Prompt engineering is an art, and well-structured prompts dramatically improved the quality of vulnerability descriptions and remediation suggestions.
I learned important lessons about development with AI. Codex accelerates development significantly, with the ability to describe functionality in natural language and let Codex generate the implementation speeding up my development by at least 50 percent. Testing is non-negotiable, as even AI-generated code needs thorough testing.
I gained practical security insights. Detection is only half the battle, as fixing vulnerabilities is often harder than finding them. Education is key, as developers need to understand why a vulnerability is dangerous. AI-powered security assistants can help reduce alert fatigue for security teams by providing clear explanations and prioritized recommendations.
What's Next for VulnShield AI
My short-term roadmap includes adding support for the complete OWASP Top 10 vulnerabilities, expanding to JavaScript and Go programming languages, implementing CI/CD integration with GitHub Actions and GitLab CI, and adding an API endpoint for programmatic scanning.
In the medium term, I plan to implement machine learning-based anomaly detection, add real-time monitoring for deployed applications, integrate with Slack and Discord for alerts, and develop a custom rule engine for enterprise requirements.
My long-term vision includes automated patching with human approval workflow, compliance checking for GDPR, HIPAA, and PCI-DSS, building a community-driven vulnerability database, and creating an enterprise dashboard with analytics.
I envision VulnShield AI becoming the go-to security assistant for developers worldwide, an open-source standard for AI-powered security scanning, and a learning platform that trains developers on security best practices.
Log in or sign up for Devpost to join the conversation.