secpatch

A CI/CD-friendly developer tool that goes past alerting. It scans code with Python AST and regex rules for SQL injection, hard-coded secrets, eval()/exec(), shell=True, dynamic SQL concatenation and unsafe innerHTML. For each finding it drafts a minimal diff, written by any OpenAI-compatible model (including local ones such as Ollama) or by safe deterministic templates when no key is set. Every patch is applied in an isolated copy of the repo, syntax-checked and run against the test command; failures are discarded and only validated patches reach the working tree. It also scans commit history and ships a GitHub Actions workflow that fails builds on critical findings.

November 2026