GuardRail: BFSI Compliance & Security Scanner

Problem: In regulated industries like BFSI and FinTech, every code change carries compliance risk — hardcoded secrets, SQL injection, missing audit logs, weak hashing, or unvalidated financial inputs can trigger real regulatory penalties under PCI-DSS, RBI IT Framework, and SEBI CSCRF. Today, catching these issues depends entirely on manual code review, which is slow, inconsistent, and easy to miss under deadline pressure. Solution: GuardRail is an AI-powered compliance and security reviewer built specifically for BFSI/FinTech codebases. It scans a project using a combination of AST-based and pattern-based detection against a purpose-built rule set of 9 compliance-mapped rules covering hardcoded credentials, SQL injection, insecure hashing, missing audit logging, missing input validation, missing rate-limiting, and more. Each finding is explained in plain language, mapped to the exact compliance clause it violates (PCI-DSS v4.0, RBI IT Framework, SEBI CSCRF, OWASP, CWE), and paired with a concrete fix. Target users: Developers, security reviewers, and compliance teams at banks, NBFCs, and FinTech startups who need fast, consistent pre-commit or pre-release code review without waiting on a manual audit cycle. How they interact with it: Via a CLI (`guardrail scan <path>`) for CI/CD pipelines, generating Markdown reports for humans and SARIF 2.1.0 for tooling integration, or through a lightweight Streamlit dashboard for interactive review during development. What makes it unique: Most code scanners flag generic security issues. GuardRail is domain-specific — its rule set and compliance mappings are built for BFSI/FinTech regulatory reality, not generic OWASP checklists. It also quantifies impact directly in every report (estimated review time saved, findings by severity, compliance frameworks triggered), turning a scan into a business case, not just a bug list. Effectiveness: In our own demo run against a deliberately vulnerable sample FinTech app (NovaPay), GuardRail caught all 11 planted violations (2 CRITICAL, 9 HIGH) across 4 files in seconds, correctly mapping every one to its compliance clause, with a full passing test suite (120 tests) validating the detection logic.