ReviewSentinel : Security Audit Copilot

ReviewSentinel is a developer-focused code review and security-audit copilot designed to make repetitive security review more consistent, safer, and easier to integrate into engineering workflows. The problem is familiar: developers and reviewers repeatedly inspect source code for common risks such as hardcoded credentials, unsafe SQL construction, dynamic execution, shell-command risks, weak hashing, unsafe deserialization, insecure randomness, and path traversal. The same checks are often repeated manually, while findings can remain trapped in comments or disconnected from CI workflows. When AI is introduced into review, there is also an important privacy question: how much source context should leave the local environment? ReviewSentinel addresses this with a controlled pipeline: Input → Analyze → Protect → Explain → Ship A developer can provide a bundled demonstration repository, paste a source file, or scan a public GitHub repository. The deterministic scanner then performs local code analysis using focused, repeatable rules. Findings are normalized, and credential-like values are redacted before reaching the optional AI explanation layer. The current detector library covers credential-like strings, injection-prone SQL, unsafe shell or subprocess patterns, eval/exec usage, unsafe deserialization, path traversal, weak hashing, insecure randomness, and oversized functions. The scanners follow a simple Finding contract, making them easier to test, validate, and extend. AI is deliberately optional. When configured, watsonx.ai or an OpenAI-compatible provider can provide rationale and remediation suggestions. The AI layer is not the source of truth for the raw repository. The core deterministic scanning workflow remains usable without an AI API key. ReviewSentinel also turns findings into engineering artifacts. Results can be produced as Markdown for human review, JSON for integrations, and SARIF 2.1.0 for CI and security tooling. A configurable --fail-on threshold can be used as a CI quality gate. The project includes a browser-based demo, CLI workflow, automated tests, GitHub Actions CI, and Render deployment. The live prototype demonstrates repository or pasted-code review, finding detection, secret redaction, severity and health metrics, and optional AI explanations. The current validated build provides concrete engineering evidence: 87 automated tests are passing; the synthetic demonstration repository produces 8 findings; the fixed sample produces 0 findings; and pasted-code validation produces 3 findings with secret-like input successfully redacted. These are engineering validation results rather than production-scale performance claims. IBM Bob 2.0 was used throughout the development workflow rather than being treated as a runtime dependency. Bob was used for repository-level planning, focused implementation work, test refinement, scanner hardening, and a CI repair task. The repository preserves the actual Bob task histories and session-summary screenshots in the bob_sessions directory, making the development process inspectable. ReviewSentinel is intentionally focused: it is not presented as a complete SAST platform. Its goal is to provide a practical, reproducible review baseline that combines deterministic facts, safe context handling, optional AI reasoning, and CI-ready evidence in one developer workflow.