Security Agent

Security code reviews are one of the most critical yet consistently skipped steps in software development. Developers either lack the security expertise to spot vulnerabilities, or simply don't have the time. The result: hardcoded secrets, SQL injection flaws, and insecure configurations ship to production — often unnoticed until a breach occurs. Our solution is the Security Code Review Agent — a desktop application that transforms hours of manual security review into a matter of seconds. A developer pastes any GitHub repository URL into the application and clicks Start Scan. The tool automatically fetches every code file from the repository using the GitHub API, analyzes each file for security vulnerabilities, and produces a structured report with color-coded severity levels, exact file names, line numbers, explanations of why each issue is dangerous, and recommended fixes. The application detects four categories of vulnerabilities: - Critical: Hardcoded secrets, API keys, passwords, and tokens - High: SQL injection via string concatenation, eval() code injection, and XSS - Medium: Weak cryptography (MD5/SHA-1), debug mode enabled, wildcard ALLOWED_HOSTS - Low: SSL certificate verification disabled and other best-practice gaps Target users are developers, security engineers, and open-source maintainers who want a fast, automated first-pass security review before code goes into production or before merging a pull request. The application features three views: a Findings tab showing all issues in a sortable table filterable by severity, a Scan Log tab showing live per-file progress as the scan runs, and a Report tab containing the full Markdown report ready to export. What makes it unique is its combination of accessibility and depth. It requires zero third-party Python dependencies, runs entirely on the standard library, and works on any machine with Python 3.10+. It also ships as a compiled Windows executable for users without Python installed. Despite its simplicity to use, it surfaces real, actionable security findings — not generic warnings. In our demo test against PyGoat, a deliberately vulnerable Python/Django application, the agent scanned 100 files and found 24 issues including 8 critical vulnerabilities — in seconds.