The problem
Security tools are good at finding problems and bad at explaining them. A wall of Bandit output doesn’t tell a junior developer what to change.
What it does
- Multi-tool scanning: Bandit (SAST), Safety (dependencies) and Semgrep Community Edition run on an uploaded ZIP.
- Risk score: a 0–100 score with a severity breakdown, charted with Recharts.
- AI remediation: Groq-hosted models suggest fixes, shown as vulnerable code next to fixed code. It’s optional, and the scanner works without a key.
- Scan history: past scans are stored in local SQLite.
- Docker-ready:
docker-compose up --buildbrings up the Next.js frontend and the FastAPI backend.
Design decision
The LLM never decides whether something is a vulnerability. Deterministic tools do the finding; the model only explains and proposes. That keeps the results reproducible and the AI in a role where its mistakes are cheap.