Tech Debt & Security Auditor

THE PROBLEM Enterprises IBM serves run on codebases that are years or decades old, and the engineers who wrote them are long gone. When a team inherits or audits one of these systems, the first question is always: "where do we even start?" Answering that today takes a senior engineer days or weeks of manual digging — reading old files by hand, checking git history, hunting for security red flags. That time is expensive, and it delays modernization work before it even begins. THE SOLUTION Technical Debt & Security Auditor automates that first pass. Point it at a GitHub repository, and within about a minute it returns every code file scored 0–100 on risk, sorted so the riskiest, most urgent files sit at the top — each with a plain-language explanation, a concrete suggested fix, and a rough effort estimate. HOW IT WORKS The tool has three layers. An ingestion layer clones the target repo and walks every code file, pulling git history to measure staleness. A scoring engine combines four weighted signals into one risk score per file: 30% complexity (file length and nesting depth), 25% staleness (days since last touched), 25% missing test coverage, and 20% risky patterns (hardcoded secrets, eval/exec usage, unsafe deserialization, SQL built via string concatenation, and leftover TODO/FIXME markers). A dashboard then renders this as a color-coded, filterable, sortable backlog — filterable by risk level, folder, and file type, with an animated processing state while the scan runs. TARGET USERS Engineering teams and technical leads at large organizations — exactly the kind of enterprise clients IBM serves — who need to quickly triage an unfamiliar or aging codebase before a modernization project, security audit, or new-hire onboarding. WHAT MAKES IT UNIQUE Most linters flag issues in isolation; this tool combines four different signal types into one transparent, explainable score, then pairs deterministic scoring (fast, reliable, works even offline) with an AI review layer for deeper per-file explanations — so the tool never breaks a live demo even if an AI call is slow. Beyond just reporting problems, it plugs directly into a team's existing workflow: users can export the backlog as CSV or auto-file the highest-risk items as real GitHub Issues. BUSINESS VALUE IBM's enterprise modernization business is built on exactly this pain point. This tool automates the day-one triage that every legacy modernization or security audit engagement needs — turning a multi-day manual audit into an instant, repeatable first pass, with an explainable audit trail useful for regulated industries like finance, healthcare, and government. HONEST LIMITATIONS Risky-pattern detection is currently regex-based rather than deep semantic analysis, so it can produce false positives (it once flagged its own source file, since the code that searches for the word "eval(" contains that word as text). Effort estimates are a heuristic today rather than fully AI-generated. Both are clearly documented as near-term roadmap items.