{"slug": "show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings", "title": "Show HN: PuedoBot, an OSS security auditor that tries to disprove its findings", "summary": "Developer eagle9111 released PuedoBot Core, an open-source static application security testing (SAST) auditor that pairs deterministic scanning with a two-pass AI triage pipeline designed to disprove its own findings. PuedoBot Core combines Python AST traversal, Bandit rules, Semgrep configs, OSV.dev dependency advisories and a git-history secret scanner, then runs quarantined snippets through a Triage Scout that assesses exploitability and a Skeptical Verifier that acts as a \"defense attorney to refute false alarms.\" The tool is model-agnostic, supporting cloud LLMs including DeepSeek, OpenAI, Google Gemini, Groq, Mistral and OpenRouter or fully offline local models via Ollama, vLLM and LM Studio, and stores audit findings in PostgreSQL.", "body_md": "**Developer-first static analysis security auditor (SAST) with dual-pass skeptical AI false-alarm elimination.**\n\nTraditional static security tools can flood engineering teams with false alarms, while running an entire repository through an LLM is costly, slow, and context-constrained.\n\n**PuedoBot Core** combines deterministic static analysis with intelligent AI verification:\n\n1. **Deterministic Speed** : Pinpoints suspicious sinks using AST traversal, Bandit patterns, Semgrep security rules, OSV CVE advisories, and git commit history secret scans.\n2. **Dual-Pass AI Triage** : Quarantines suspicious code snippets and evaluates them through a two-phase challenger pipeline — a**Triage Scout** assesses exploitability, followed by a**Skeptical Verifier** acting as a defense attorney to refute false alarms.\n3. **Bring Your Own AI** : Connect**ANY** cloud LLM (DeepSeek, OpenAI, Google Gemini, Groq, Mistral, OpenRouter) or run**100% offline & private** with local models (Ollama, vLLM, LM Studio).\n\n- **🔍 Multi-Engine SAST Scanner** : Simultaneously checks AST syntax patterns, Bandit security flaws, Semgrep rules, and OSV.dev dependency advisories in a single pass.\n- **🔑 Git History Secret Redaction** : Detects exposed API keys, private certificates, and database secrets across active files and historical git commits with automatic regex redaction.\n- **🧠 Dual-Pass Skeptical AI Triage** :\n  - *Pass 1 (Exploitation Analysis)* : Traces data sources to sinks, identifies missing sanitizers, and estimates blast radius.\n  - *Pass 2 (Challenger Refutation)* : Actively searches for framework protections, defensive guards, and dead code to eliminate false positives before presenting findings.\n- **🌐 Universal Model Compatibility** : Completely model-agnostic. Plug in DeepSeek, OpenAI, Gemini, Groq, or self-host open-weights models (Qwen 2.5 Coder, Llama 3, DeepSeek-R1) via Ollama or vLLM.\n- **💻 Rich Interactive CLI** : Terminal dashboards with highlighted code proof dossiers, confidence scores, and review workflows.\n- **🔒 Privacy First & Air-Gapped Ready** : When configured with local inference, zero code or tokens leave your environment.\n\n``` php\nflowchart TD\n    A[Target Codebase / Repository] --> B[Deterministic Engine]\n    \n    subgraph Sinks [\"Multi-Engine Static Detection\"]\n        B --> B1[Python AST Traversal]\n        B --> B2[Bandit Rules]\n        B --> B3[Semgrep Configs]\n        B --> B4[OSV Dependency CVEs]\n        B --> B5[Git Secret Scanner]\n    end\n\n    Sinks --> C{Findings Detected?}\n    C -->|No| D[Clean Audit Report]\n    C -->|Yes| E[Quarantined Code Context]\n\n    subgraph AI [\"Dual-Pass AI Verification (Any LLM)\"]\n        E --> F[Pass 1: Triage Scout<br/>Analyzes Flow & Exploitability]\n        F --> G[Pass 2: Skeptical Verifier<br/>Challenges & Refutes False Positives]\n    end\n\n    AI --> H[Verified Security Findings Dossier]\n    H --> I[Interactive Terminal Review CLI]\n```\n\nPuedoBot Core stores repository audit findings, triage status, and code context in PostgreSQL.\n\nStart a local database in seconds using Docker:\n\n```\ndocker run -d --name puedobot-db -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_DB=puedobot postgres:16-alpine\ngit clone https://github.com/eagle9111/Puedobot-Open-Source.git\ncd Puedobot-Open-Source\npython3 -m venv .venv\nsource .venv/bin/activate\n\n# Editable install with core dependencies:\npip install -e .\n\n# (Optional) Install with Semgrep support for multi-language rule auditing:\npip install -e \".[semgrep]\"\n```\n\nNote\n\nWithout `[semgrep]`, non-Python files (JS, Go, Java, PHP) receive git secret scanning and OSV dependency tracking, while Python files receive full AST, Bandit, secret, and OSV scanning.\n\nCopy the sample environment file:\n\n```\ncp .env.example .env\n```\n\nGenerate a secure 32+ character API key for server authentication:\n\n``` python\nopenssl rand -hex 32\n# Or via Python:\npython3 -c \"import secrets; print(secrets.token_hex(32))\"\n```\n\nConfigure your database and AI preference in `.env`:\n\n```\n# Server API Authentication (Required: at least 32 characters)\nPUEDOBOT_API_KEY=paste_your_generated_32_byte_secret_here\n\n# Use any OpenAI-compatible API:\nAI_API_URL=https://api.deepseek.com/v1     # Or OpenAI, Groq, OpenRouter, etc.\nAI_API_KEY=your_api_key_here\nMODEL_NAME=deepseek-chat\n\n# Or use Google Gemini directly:\n# AI_API_URL=\n# AI_API_KEY=your_gemini_api_key_here\n# MODEL_NAME=gemini-2.5-flash\nPUEDOBOT_API_KEY=paste_your_generated_32_byte_secret_here\n\nLOCAL_AI_URL=http://localhost:11434/v1\nLOCAL_AI_MODEL=qwen2.5-coder:7b\nAI_PRIORITY=local\n# Ensure your virtual environment is active:\nsource .venv/bin/activate\n\n# 1. Initialize DB tables\npython3 -m scripts.init_db\n\n# 2. Start the background scan service\nuvicorn app.server.main:app --host 127.0.0.1 --port 8000 &\n\n# 3. Audit any project or repository\npuedobot scan /path/to/target/project\n```\n\nTip\n\nRun `puedobot --help` (or simply `puedobot`) at any time to reveal all commands, subcommands, arguments, and flag options.\n\n| Command | Description | \n|---|---|\n| `puedobot scan <path>` | Run a comprehensive multi-engine audit against target code | \n| `puedobot show-errors` | Display interactive table of all verified security findings | \n| `puedobot show <id>` | Inspect detailed vulnerability dossier and syntax-highlighted code proof | \n| `puedobot review <id> <approve\\|reject>` | Mark a finding as verified or dismissed | \n| `puedobot repos` | List audited repositories and status | \n| `puedobot activity` | Stream active audit jobs and status | \n\nPuedoBot Core is created for authorized, defensive security auditing, pre-commit CI/CD quality gates, and code hardening.\n\nApache 2.0. See [LICENSE](https://github.com/eagle9111/Puedobot-Open-Source/blob/main/LICENSE) for details.", "url": "https://wpnews.pro/news/show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings", "canonical_source": "https://github.com/eagle9111/Puedobot-Open-Source", "published_at": "2026-10-23 12:18:36+00:00", "updated_at": "2026-10-23 12:42:35.224768+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents", "ai-safety"], "entities": ["PuedoBot Core", "eagle9111", "Bandit", "Semgrep", "OSV.dev", "DeepSeek", "OpenAI", "Ollama"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings", "markdown": "https://wpnews.pro/news/show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings.md", "text": "https://wpnews.pro/news/show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings.txt", "jsonld": "https://wpnews.pro/news/show-hn-puedobot-an-oss-security-auditor-that-tries-to-disprove-its-findings.jsonld"}}