RepoShield AI — AI-Powered GitHub Repository Security Scanner

RepoShield AI is an open-source security project designed to help developers identify security risks in their GitHub repositories before attackers can exploit them. Recent reports of unauthorized access to GitHub repositories and attacks involving malicious GitHub Actions workflows highlight the importance of securing source code, credentials, and CI/CD pipelines.

The project combines established security scanning tools with Google Gemma 4 to help developers understand security findings and learn how to fix them.

Key Features

• Secret Detection: Identify exposed API keys, access tokens, passwords, and other credentials using Gitleaks.
• Sensitive Data Detection: Flag potentially exposed personal information in source code and configuration files.
• GitHub Actions Security: Analyze workflow files for suspicious commands, unsafe configurations, and potential secret exfiltration.
• Git History Scanning: Help identify secrets that may remain in previous commits, even after removal from current code.
• Dependency Vulnerability Checks: Identify known vulnerabilities in supported project dependencies.
• AI-Powered Explanations: Use Gemma 4 to explain findings, assess potential impact, and recommend remediation steps.
• Developer-Friendly Reports: Present security findings with severity levels, affected files, explanations, and suggested fixes.

How It Works

A developer submits a GitHub repository URL. RepoShield AI retrieves the repository, runs relevant security checks, and organizes the findings. Gemma 4 then helps explain the results in clear language and suggests practical remediation steps.

Technology Stack

Python, FastAPI, Gitleaks, Google Gemma 4 through an LLM integration, GitHub repositories, and automated security testing.

Goal

The goal is to make repository security more accessible to students, beginner developers, and open-source contributors by helping them identify common security mistakes early and understand how to address them.

RepoShield AI — Scan smarter. Understand risks. Secure your code.

Project status: Under development. Features and scanning coverage will depend on implementation and testing.