Modern software teams merge hundreds of Pull Requests every day, but traditional static analysis tools often generate excessive false positives, lack contextual understanding, and provide little insight into the overall risk of a code change.
To address this challenge, I built DevDiff—a Real-Time Pull Request Risk Intelligence Platform that combines rule-based security analysis, machine learning, and optional Large Language Model (LLM) reasoning to identify risky code changes before they reach production.
Rather than simply listing vulnerabilities, DevDiff helps developers understand how risky a Pull Request is, why it is risky, and how those risks evolve over time.
Existing security scanners typically suffer from several issues:
These limitations reduce developer trust and often cause important security issues to be ignored.
DevDiff aims to solve these problems with an intelligent, adaptive approach to Pull Request analysis.
As soon as a Pull Request is opened or updated, DevDiff analyzes the changes in real time and streams findings directly to the dashboard using WebSockets.
DevDiff includes a custom 20-rule security engine capable of identifying common security vulnerabilities, including:
The engine performs fast pattern-based detection with minimal latency.
Not every vulnerability has the same impact.
To improve prioritization, DevDiff uses a Random Forest Machine Learning model trained on 15 engineered code features.
The model assigns a risk score to every finding, helping developers focus on the issues most likely to become real security threats.
Current model performance:
For more complex Pull Requests, DevDiff can perform a deeper semantic review using Groq-powered Large Language Models. Instead of relying only on pattern matching, the LLM can reason about:
This review is optional to reduce cost while still providing advanced insights when needed.
DevDiff goes beyond vulnerability detection by providing developer-focused analytics.
The platform includes:
This helps engineering teams identify long-term security patterns rather than reviewing issues one Pull Request at a time.
DevDiff integrates directly with GitHub using OAuth authentication.
Features include:
Developers can scan their code before creating a Pull Request using the DevDiff CLI.
This enables security issues to be detected during local development rather than after code review.
One of DevDiff's most unique capabilities is its ability to learn from developers.
When a developer marks a finding as a false positive, DevDiff records that feedback and gradually adjusts future detection thresholds.
Over time, this significantly reduces repetitive false positives while preserving detection accuracy.
DevDiff now remembers previous findings across repositories and developers.
The memory system stores:
This enables the platform to make more informed decisions over time instead of treating every Pull Request as completely new.
LLM-based analysis can become expensive at scale.
To solve this, DevDiff introduces CascadeFlow, an intelligent model-routing system.
CascadeFlow:
This makes AI-powered code review significantly more cost-effective without sacrificing quality.
Planned improvements include:
DevDiff combines traditional static analysis, machine learning, adaptive memory, and modern AI into a single platform for intelligent Pull Request security review.
By providing real-time risk intelligence, personalized learning, and cost-efficient AI analysis, DevDiff helps development teams detect security issues earlier, reduce false positives, and make code reviews faster and more reliable.
This project represents my vision of bringing intelligent, adaptive security directly into the developer workflow—where secure software starts.