BobGuard: Autonomous Git Security & Remediation

BobGuard is an agentic DevSecOps security gatekeeper designed to shift code security left—intercepting vulnerabilities directly inside local developer environments before they enter version control history or CI/CD pipelines. How It Works Interception: Configured via system-level Git pre-commit hooks (.git/hooks/pre-commit), BobGuard automatically pauses execution whenever a developer runs git commit. Static Detection Engine: Built in Python, the scanner inspects staged code diffs (git diff --cached) using regular expressions (detecting AWS keys, database URIs, dynamic SQL syntax) alongside Shannon entropy mathematical calculations to pinpoint high-randomness string patterns (API tokens, secret keys). Structured Audit Output: If security risks are detected, BobGuard aborts the commit with a non-zero exit code and outputs a machine-readable report (bobguard-report.json). Agentic Self-Healing with IBM Bob: IBM Bob operates in Agent Mode inside VS Code to parse bobguard-report.json findings, autonomously refactoring non-compliant code (e.g., converting hardcoded credentials to os.getenv environment variables). Re-Validation: On re-staging and committing, BobGuard verifies that 0 findings remain and permits the commit to complete cleanly. Key Features Zero-Trust Hook Architecture: Intercepts sensitive files locally, preventing credentials from ever reaching remote repositories. Shannon Entropy Analysis: Identifies high-randomness secret strings even when known regular expression rules fail. Autonomous Remediation: Closes the gap between vulnerability detection and patch execution through IBM Bob's AI agentic loop. Standardized JSON Artifacts: Generates structured compliance and audit logs for team monitoring.