AI code review & release-risk assistant – automated vulnerability detection and deployment readiness platform

Author

Mrs. Manimegala Prasath, Vishwa B, Vijay K, Srihari K


Abstract

The AI Code Review & Release-Risk Assistant is a web-based DevSecOps platform that inspects source code, finds security weaknesses and estimates how risky it is to release a software version. A developer submits a public GitHub repository or a ZIP archive. The system checks the input, places it in an isolated workspace, detects the programming languages and scans the code with an abstract-syntax-tree (AST) engine and a set of heuristic pattern detectors for Python, JavaScript/TypeScript, Java and C/C++. A universal scanner also looks for hard-coded credentials such as cloud access keys, personal access tokens and private keys. The findings can be explained by a Large Language Model (Google Gemini, OpenAI, or a local Ollama model) or by a built-in offline engine that needs no external service. A severity-weighted scoring model then converts all findings into a release-risk score from 0 to 100 and a clear verdict: GO FOR RELEASE, PROCEED WITH CAUTION or NO-GO. The platform is built with a FastAPI backend, uses temporary workspaces with several protections against unsafe archives, and includes a ground-truth benchmark. On its built-in benchmark of ten vulnerability scenarios across four languages, the system reached 100% precision and recall; because this benchmark is small, the figure shows that the detectors work as designed and is not a claim of general accuracy.


Keywords

Static Code Analysis, Vulnerability Detection, Release-Risk Scoring, DevSecOps, Large Language Models, Abstract Syntax Tree, Secret Detection, FastAPI



Full Text:

Download Paper PDF


References


  • Chen, M., Tworek, J., Jun, H., et al. (2021). Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374.
  • Chess, B., & West, J. (2007). Secure programming with static analysis. Boston, MA: Addison-Wesley.
  • Forsgren, N., Humble, J., & Kim, G. (2018). Accelerate: The science of lean software and DevOps. Portland, OR: IT Revolution Press.
  • (2024). Gemini API documentation. https://ai.google.dev/
  • Halstead, M. H. (1977). Elements of software science. New York: Elsevier North-Holland.
  • McCabe, T. J. (1976). A complexity measure. IEEE Transactions on Software Engineering, SE-2(4), 308–320.
  • MITRE Corporation. (2024). Common Weakness Enumeration (CWE). https://cwe.mitre.org/
  • (2024). Ollama: Run large language models locally. https://ollama.com/
  • OWASP Foundation. (2021). OWASP Top Ten. https://owasp.org/www-project-top-ten/
  • Powers, D. M. W. (2011). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. Journal of Machine Learning Technologies, 2(1), 37–63.
  • (2024). Bandit: Security linter for Python code. https://bandit.readthedocs.io/
  • pytest-dev. (2024). pytest documentation. https://docs.pytest.org/
  • Python Software Foundation. (2024). ast — Abstract syntax trees. Python 3 documentation. https://docs.python.org/3/library/ast.html
  • Ramírez, S. (2024). FastAPI. FastAPI documentation. https://fastapi.tiangolo.com/
  • Semgrep, Inc. (2024). Semgrep documentation. https://semgrep.dev/docs/

 

 

Share your valuable work from Social Media Buttons