Astro-Guardian AI-Powered Security Guardian

Astro-Guardian — Project Description Most development teams discover security vulnerabilities the wrong way through a breach, a CVE alert email, or a panicked message after a dependency they shipped months ago turns out to be exploitable. The manual response is slow: find the affected package, find the safe version, update the manifest, test the build, open a PR for every repository, every vulnerability, every time. Astro-Guardian automates that entire response pipeline. The Problem Open-source dependency vulnerabilities are published daily to databases like Google OSV and the NVD. Most teams have no automated mechanism to detect when a package they already depend on becomes vulnerable, let alone patch it before it becomes a risk. Secrets accidentally committed to repositories API keys, database passwords, cloud credentials compound the problem. Manual security reviews are slow, inconsistent, and don't scale across multiple repositories. The Solution Astro-Guardian is a GitHub-integrated security bot that connects to your repositories via a GitHub App, scans them automatically, and delivers a verified patch as a Pull Request without a human touching a keyboard. When a scan is triggered, the platform: Clones the target repository into an isolated workspace on the server Invokes IBM Bob Shell CLI non-interactively to run Gitleaks (hardcoded secret detection) and Semgrep (p/secrets ruleset) across the entire codebase Queries the live Google OSV API and runs npm audit to identify every declared dependency that has a known CVE, and discovers the exact safe version to pin to Rewrites the dependency manifest (supports Node.js package.json, Python requirements.txt, and Java pom.xml) with the patched versions Validates the patch by spinning up a real isolated Docker container for the detected language Node, Python, Java, PHP, or Go and streaming the build and audit output live to the user Commits and pushes the patch branch and opens a GitHub Pull Request with a full SECURITY_REPORT.md attached, covering every CVE fixed, every secret detected, and the complete IBM Bob output The entire pipeline streams back to a live React dashboard via Server-Sent Events, so developers can watch each stage checkout, scanning, patching, Docker validation, PR creation in real time. Target Users Engineering teams and solo developers who maintain GitHub repositories and want automated, auditable security patching without a third-party SaaS product. The platform is self-hosted code never leaves the team's own infrastructure. What Makes It Unique The combination of IBM Bob Shell CLI for AI-driven analysis, real live OSV/NVD database querying rather than a static lookup table, per-language Docker validation before any code is pushed, and a full audit trail in PostgreSQL sets Astro-Guardian apart from simple version-bump bots. Future Enhancement: watsonx.ai Currently IBM Bob handles the AI analysis layer. The next planned enhancement is integrating watsonx.ai with IBM Granite to enrich every Pull Request with natural-language CVE explanations describing the attack surface, exploitability rating, and whether the version bump alone is sufficient or additional code hardening is needed. This will transform Astro-Guardian's PRs from mechanical version bumps into trusted, reviewable security decisions.