hosted at : http://nzecxtransfinitte.tech/
- Shreyash Verma
- Avyyukt Ajith
- Arush Pimpalkar
- Nikhil Sharma
- Ayush Sharma
This project addresses the challenges in modern software development where security vulnerabilities can be introduced across multiple programming languages. Manually identifying these issues is error-prone and time-consuming. Our solution, an LLM-powered chatbot, assists developers by detecting vulnerabilities in code and providing real-time suggestions for fixes.
Modern software development often leads to security vulnerabilities across multiple languages. Manual detection is inefficient, and there is no unified solution for multi-language code analysis. Key challenges include:
- Lack of centralized tools for multi-language vulnerability detection.
- Identification of common vulnerabilities like SQL injections and buffer overflows.
To create a system that:
- Analyzes code in multiple languages for vulnerabilities.
- Provides real-time fixes to enhance code security.
-
Query Handling:
- The system identifies if the user input is a code snippet or a GitHub repository.
-
Code Snippet Analysis:
- Code snippets are processed to generate embeddings, and a similarity search is conducted using a vulnerability database.
- The top matches are used to create an augmented prompt for an LLM to generate a detailed response.
-
GitHub Repository Analysis:
- The system uses CodeQL to analyze repositories for vulnerabilities.
- Vulnerable code segments are then processed through the LLM for analysis and fix recommendations.
-
Output:
- A detailed report is generated, outlining vulnerabilities and corresponding fixes.
- Frontend: React.js, Tailwind CSS
- Backend: FastAPI, Typescript
- Vulnerability Analysis: CodeQL, LLM-powered chatbot
- Code Security Audits: Automatically detect vulnerabilities before deployment.
- Real-Time Developer Assistance: Offer real-time security checks and fixes while coding.
- GitHub Repository Scanning: Scan entire repositories for vulnerabilities via a GitHub link.
- Support for More Programming Languages: Expand the app to support additional languages and frameworks.
- IDE Integration: Develop plugins for popular IDEs like VS Code and IntelliJ for real-time vulnerability detection within the coding environment.
- Continuous Monitoring in CI/CD: Integrate continuous security checks in CI/CD pipelines for ongoing protection throughout the development lifecycle.
- Clone the repository.
- Install dependencies using:
- Run the development server:
- For the backend, navigate to the backend directory and use:
- To use the GitHub repository scanner, ensure CodeQL is installed and properly configured.