Original Summary

Traditional SAST tools drown you in false positives, while dumping an entire repo into an LLM is slow, expensive, and hits context limits fast. ​To fix this in my own workflow, I built PuedoBot a CLI security auditor that uses deterministic scanning to find suspicious code, and a two-pass LLM pipeline where the second pass actively tries to disprove the first one's findings. ​ How the pipeline works: ​ Deterministic Sweep: Runs AST sink traversal, Bandit, Semgrep rules, OSV.dev dependency checks, and a git history secret scan (with auto-redaction). ​ Quarantine: Instead of sending the whole codebase, only the flagged snippets are extracted and wrapped as untrusted input to prevent prompt injection from malicious code comments or strings. ​ Pass 1 (The Scout): Traces data from source to sink, checks for missing sanitizers, and estimates the blast radius. ​ Pass 2 (The Defense Attorney): A separate pass whose sole job is to refute Pass 1. It looks for framework-level protections, upstream guards, or dead code paths that make the alert a false alarm. You only see the finding if it survives the argument. ​ Model Agnostic: You can plug in your preferred model provider (OpenAI, DeepSeek, Gemini, Anthropic, Groq, Mistral, OpenRouter, or local options via Ollama/vLLM/LM Studio). ​ What’s in this repo vs. my personal build: I’m open-sourcing the core scanning and dual-pass triage engine (Apache 2.0) so anyone can run it against their own code. Full transparency: this was extracted from a larger, private CLI build I run exclusively for my own research. My personal rig includes autonomous repo discovery with a 6-month cooldown per repo to protect open-source maintainers from automated noise, model failover, and a responsible-disclosure workflow. I kept the autonomous discovery private for safety reasons, but the core auditing engine is fully open source. ​ Stack: Python 3.11+, FastAPI/uvicorn, PostgreSQL, Bandit, Semgrep (optional), OSV.dev. ​ Repo: https://github.com/eagle9111/Puedobot-Open-Source   submitted by   /u/No-Bumblebee-3536 [link]   [comments]

  • 情报分类：工作与职业机会
  • 分类依据：内容涉及招聘、求职或职业发展
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/17 01:42:12