SecureLens — AI-Assisted AppSec Analysis & Local Security Investigation Layer

[AI-Assisted AppSec Analysis & Local Security Investigation Layer]

 ███████╗███████╗ ██████╗██╗   ██╗██████╗ ███████╗██╗     ███████╗███╗   ██╗███████╗
 ██╔════╝██╔════╝██╔════╝██║   ██║██╔══██╗██╔════╝██║     ██╔════╝████╗  ██║██╔════╝
 ╚█████╗ █████╗  ██║     ██║   ██║██████╔╝█████╗  ██║     █████╗  ██╔██╗ ██║███████╗
  ╚═══██╗██╔══╝  ██║     ██║   ██║██╔══██╗██╔══╝  ██║     ██╔══╝  ██║╚██╗██║╚════██║
 ██████╔╝███████╗╚██████╗╚██████╔╝██║  ██║███████╗███████╗███████╗██║ ╚████║███████║
 ╚══════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═╝  ╚═╝╚══════╝╚══════╝╚══════╝╚═╝  ╚═══╝╚══════╝

SecureLens is an AI-assisted AppSec analysis platform that sits above security scanners and turns raw code and web-security findings into prioritized, explainable security investigations and remediation guidance with deterministic 0–100 risk scoring.

# Offline code scanning with `--no-ai` runs locally without sending code to an external LLM provider

Install CLI Try Live Playground

securelens://live-analysis/pattern-graph

ACTIVE MONITOR

|112 tests passing (100%)

Deterministic Scoring EngineGrade: D (68/100)

Found 1 Critical (AWS Key ID: -20), 1 High (shell=True: -12). Threat context & remediation ready.

Detection tools find raw alerts.
Engineering teams struggle with the investigation.

Security detection tools identify potential vulnerabilities across repositories and web targets. But teams often struggle with the post-detection workflow: understanding architectural context, triaging severity, explaining impact to developers, and prioritizing remediation steps.

ℹ Scope & Boundaries

SecureLens is not a replacement for specialized security scanners such as Semgrep, SonarQube, CodeQL, Gitleaks, TruffleHog, Trivy, Snyk, or OWASP ZAP. Instead, SecureLens provides an orchestration, triage, scoring, explanation, and interactive investigation layer designed to make security findings easier to analyze, prioritize, and remediate.

RAW FINDINGS → CONTEXTUAL INVESTIGATION PIPELINEPOST-DETECTION LAYER

Local Codebase

Secrets / Patterns

Web Target / URL

TLS & Headers

│ │ │ │
▼ ▼ ▼ ▼

Path Discovery

Regex Rules

SSRF Guard

Config Audits

╲ │ │ ╱
╲ │ │ ╱
▼ ▼ ▼ ▼
┌─────────────────────────────────────────────────────────────────┐
│ SECURELENS INVESTIGATION & TRIAGE LAYER │
│ • Deterministic Risk Scoring (0–100 Scale & Grades A–F) │
│ • Security-Sensitive File Triage (Auth, DB, Routes) │
│ • Optional AI-Assisted Threat Context & Remediation Guidance │
│ • Interactive REPL Shell + Multi-Format Reports (PDF / JSON) │
└─────────────────────────────────────────────────────────────────┘
✓ Prioritized Findings · Explainable Risk · Actionable Guidance

01 · Unified Local Workflow

Code & Web Analysis in One CLI

Consolidates local repository scanning (secrets, SQL formatting, command execution) and live web configuration audits (TLS, security headers, cookie flags) into a single tool.

02 · Transparent Scoring

Deterministic Severity Deductions

Severity scoring is deterministic rather than LLM-generated: Base 100 with transparent deductions (-20 Critical, -12 High, -5 Medium, -2 Low) mapped to letter grades.

03 · Remediation Guidance

Contextual Explanation & Advice

Provides code-level remediation suggestions and threat explanations, with an interactive terminal REPL to drill down into active findings.

Deterministic risk scoring.
Audited test baseline.

Severity scoring is deterministic rather than LLM-generated. SecureLens calculates objective risk scores from finding severities, backed by a comprehensive automated test suite.

# Automated test suite pass rate

  ██    ██   ██████
 ███   ███  ██    ██
  ██    ██      ███ 
  ██    ██    ███   
████████████████████

112 passed / 112 total tests

100%

pytest & asyncio suite

CLI · Web Scanner · Auth · Webhooks · Reports ↗

# Deterministic risk scoring scale

 ██████   ██    ██████
██    ██  ██   ██    ██
██    ██  ██   ██    ██
██    ██  ██   ██    ██
 ██████   ██    ██████

Base 100 with deduction bounds

Crit: -20 ptsHigh: -12 ptsMed: -5 ptsLow: -2 pts

Deterministic deductions

Letter Grade Scale: A (90+), B (80+), C (70+), D (60+), F (<60) ↗

# Local Offline Mode (`--no-ai`)

  ██   ██████  ██████
 ███   ██  ██  ██  ██
  ██   ██  ██  ██  ██
  ██   ██  ██  ██  ██
██████ ██████  ██████

Local execution

Zero Code Leaks

No remote calls when offline

Deterministic regex rules execute locally without external LLM ↗

Six pillars of the SecureLens architecture.

Combines deterministic code checks, live web exposure audits, transparent risk deductions, and optional AI explanations into a unified investigation workflow.

offline ready
codebase pattern engine
deterministic local analysis
Traverses local repositories honoring .gitignore rules. Uses regex pattern checks for hardcoded AWS keys, private keys, dangerous functions (eval/exec), shell=True, and raw SQL formatting.
MODULE // 01VERIFIED →
ssrf guarded
web configuration & exposure
live target audit & ssrf guard
Audits SSL/TLS certificates, expiry dates, HSTS, CSP, and security headers. Probes sensitive endpoints (.env, .git) with strict RFC 1918 private IP SSRF blocking.
MODULE // 02VERIFIED →
optional ai
optional ai threat triage
contextual explanations & advice
LiteLLM multi-provider integration (Gemini, Claude, GPT, Ollama) contextualizes findings, identifies security-sensitive files, and provides advisory remediation guidance.
MODULE // 03VERIFIED →
prompt_toolkit
stateful interactive repl
in-memory investigation shell
Unified CLI shell maintains active scan memory. Query findings with /issues critical, ask follow-up questions, switch models dynamically, and export reports.
MODULE // 04VERIFIED →
verifiable math
deterministic risk scoring
0–100 scale & letter grades
Severity scoring is deterministic rather than LLM-generated. Deducts -20 for Critical, -12 for High, -5 for Medium, and -2 for Low from a base score of 100.
MODULE // 05VERIFIED →
fpdf2 + ci
reports & ci pipeline exit codes
pdf, json, markdown & ci mode
Generates styled PDF security reports with FPDF2, exports machine-readable JSON/Markdown, and supports automated pipelines via --ci --fail-on high.
MODULE // 06VERIFIED →

Explore the SecureLens workflow live.

Interactive demonstration of the triage workflow: inspect code findings, observe transparent risk calculations, toggle offline modes, or test interactive REPL commands.

Offline Mode (`--no-ai`)

Select Scope Sample:

services/api/ (Full Project)auth.py:5 & runner.py:6

# File 1: services/auth.py:5
AWS_ACCESS_KEY_ID = "AKIA...REDACTED"
AWS_SECRET_ACCESS_KEY = "REDACTED"

# File 2: utils/runner.py:6
cmd = f"python scripts/{user_script_name}"
subprocess.check_output(cmd, shell=True)

Triage + LiteLLM

Deterministic Risk Score

68/100Grade: D

-32 pts penaltyBase 100 - Deductions

1 Critical (AWS Key: -20 pts) + 1 High (shell=True: -12 pts)

Multi-Finding Scope

Full repository scan identified 1 Critical credential exposure in auth.py (-20 pts) and 1 High command injection risk in runner.py (-12 pts).

Remediation Guidance:

Revoke the AWS key and load credentials via IAM roles. Refactor subprocess calls to use structured argument lists with shell=False.

Suggested Code-Level Refactor

# 1. Use IAM Roles in auth.py:
boto3.client('s3')

# 2. Use list arguments with shell=False in runner.py:
subprocess.check_output(["python", f"scripts/{user_script_name}"], shell=False)

Export: JSON · Markdown · PDFCLI Ready ✓

From raw findings to explainable investigation.

A structured analysis pipeline that discovers files, applies deterministic rules, calculates mathematical risk scores, and delivers explainable investigations across CLI and reports.

TARGET

FILTER & SCOPE

DETECTION

OPTIONAL AI

DELIVERY

Local Repo / URL

$ securelens scan .─────▶Traverse workspace honoring .gitignore

Target Verified

SSRF Guard & Ignore Spec

─────▶Blocks RFC 1918 private IPs · Prunes node_modules & binaries

Candidate Files

Triage Queue

Regex Pattern Match

─────▶Flags AWS Keys (-20), shell=True (-12), SQL Interpolation (-12)

Raw Matches

Security-Sensitive

Finding Objects

OWASP AI Context

──▶Advisory guidance

Scan Completed

Deductions: -32 pts

2 Findings

Score: 68/100 (D)

REPL · PDF · CI Exit 1

STEP 01INGEST & SCOPE

Target Acquisition

Accepts local repository paths or live URLs. Traverses directories honoring .gitignore and filters out binary assets. Validates web hostnames and enforces RFC 1918 private IP SSRF blocking.

STAGE 01 / 04PIPELINE ✓

STEP 02PATTERN RULES

Deterministic Checks

Scans candidate files with deterministic regex rules for hardcoded credentials, private keys, eval/exec, shell=True, and raw SQL string formatting. Audits TLS certs and web security headers.

STAGE 02 / 04PIPELINE ✓

STEP 03OPTIONAL AI

OWASP Context & Triage

When enabled, LiteLLM analyzes security-sensitive files (auth handlers, DB connectors, routes) to provide threat context and code-level remediation suggestions. Fully bypassable with --no-ai.

STAGE 03 / 04PIPELINE ✓

STEP 04OUTPUT & CI

Scoring & Investigation

Computes transparent 0–100 risk score and letter grade. Loads findings into the stateful interactive CLI REPL, exports local PDF/Markdown/JSON reports, and sets CI pipeline exit codes.

STAGE 04 / 04PIPELINE ✓

Works with your AI models and infrastructure.

Configure your preferred LLM provider via LiteLLM or run completely offline with deterministic rules and local Ollama inference.

AI Providers (LiteLLM Integration)

Low Latency

Google Gemini 2.0 Flash

Default & Verified

Reasoning

Anthropic Claude

Supported (LiteLLM)

Precision

OpenAI GPT-4o / Mini

Supported (LiteLLM)

No External API Key

Ollama (Local Llama 3.1)

Local / Offline

Current Verified Architecture Components

#Nuclei Integration

Invoked via safe subprocess runner (shell=False) when binary is present; skips gracefully if absent.

COMPONENT // 01

#FastAPI REST Server

Central backend managing JWT authentication, API keys, and scan synchronization.

COMPONENT // 02

#PostgreSQL & SQLite

Async SQLAlchemy 2.0 with strict tenant data isolation.

COMPONENT // 03

#FPDF2 Report Generator

Locally compiled executive PDF security scorecards and remediation notes.

COMPONENT // 04

#HMAC-SHA256 Webhooks

Cryptographically signed scan payloads dispatched to registered endpoints.

COMPONENT // 05

#APScheduler Background

Async recurring scan jobs and automated web surface monitoring.

COMPONENT // 06

⚙Project Roadmap (Planned Capabilities)FUTURE RELEASES

○Native CI/CD Action Packages

Reusable GitHub Actions and GitLab CI workflows (current: --ci CLI exit codes)

PLANNED

○Dependency & SCA Auditing

Software Composition Analysis integrated against the OSV vulnerability database

PLANNED

○Automated PR Generation

Automated Git branch and remediation PR creation from confirmed fixes

PLANNED

○Custom YAML Rule Engine

User-defined YAML security pattern rules for custom organizational policies

PLANNED

Start investigating your app security posture.

Install the lightweight CLI for local scanning or deploy the central FastAPI server with PostgreSQL and Docker Compose for team persistence and scan synchronization.

pipx / pip binary

pipx install git+https://github.com/Rarebuffalo/securelens-backend.git#subdirectory=cli
securelens configure
securelens scan .

securelens://api/live-endpoints

ONLINE

Public Backend Deployment

https://securelens-backend.onrender.comSwagger Docs

Healthcheck endpoint: GET /health

Code & Web Analysis in One CLI

Deterministic Severity Deductions

Contextual Explanation & Advice

codebase pattern engine

web configuration & exposure

optional ai threat triage

stateful interactive repl

deterministic risk scoring

reports & ci pipeline exit codes

Target Acquisition

Deterministic Checks

OWASP Context & Triage

Scoring & Investigation

Start investigating your app security posture.