DevGuard AI is a hybrid static analysis and LLM-assisted code security diagnostic platform designed to detect runtime vulnerabilities, injection vectors, and insecure programming patterns in Python codebases.
DevGuard combines two complementary layers of analysis:
- Deterministic Static Rule Engine: High-throughput client-side heuristic engine scanning for Common Weakness Enumerations (CWEs) including CWE-89 (SQL Injection), CWE-78 (Command Injection via
shell=True), CWE-502 (InsecurepickleDeserialization), and CWE-798 (Hardcoded Secrets). - Generative Context Audit: Deep semantic audit powered by Google Generative AI (Gemini 3.8 Flash) to detect contextual flaws across multi-line scopes, including path traversal (
os.path.join), unprotected API endpoints, and production debug modes. - Domain-Specific SLM (LoRA Adapter): Fine-tuned
Qwen2.5-Coder-1.5B-Instructusing 4-bit QLoRA on curated secure-coding instructions, hosted directly on the Hugging Face Hub.
- Deterministic vs. Generative Auditing: Dual-scan approach ensuring fast heuristic filtering followed by deep AST/contextual reasoning.
- Line-Level Diagnostic Reports: Pinpoints vulnerable lines with CWE mapping, risk severity classification (CRITICAL, HIGH, MEDIUM, LOW), and actionable remediation snippets.
- Client-Side Privacy: Executes static rules and interacts with LLM endpoints directly from the browser; sensitive keys remain in local storage.
- JSON Audit Export: Generates structured vulnerability reports for integration with CI/CD pipelines.
The companion LoRA adapter trained for this project is available on Hugging Face:
- Model Hub:
https://huggingface.co/nehalkamal7/devguard-qwen-1.5b-security
- Frontend / Engine: HTML5, CSS3 (Enterprise Dark UI), Vanilla JavaScript (ES6+)
- LLM / APIs: Google Gemini 3.8 Flash REST API
- Model Fine-Tuning: PyTorch, Hugging Face
transformers,peft(QLoRA),bitsandbytes,trl - Deployment: Hugging Face Spaces (Static SDK)
Check out the live interactive space on Hugging Face: DevGuard AI Live Space