Show HN: PuedoBot, an OSS security auditor that tries to disprove its findings Developer eagle9111 released PuedoBot Core, an open-source static application security testing (SAST) auditor that pairs deterministic scanning with a two-pass AI triage pipeline designed to disprove its own findings. PuedoBot Core combines Python AST traversal, Bandit rules, Semgrep configs, OSV.dev dependency advisories and a git-history secret scanner, then runs quarantined snippets through a Triage Scout that assesses exploitability and a Skeptical Verifier that acts as a "defense attorney to refute false alarms." The tool is model-agnostic, supporting cloud LLMs including DeepSeek, OpenAI, Google Gemini, Groq, Mistral and OpenRouter or fully offline local models via Ollama, vLLM and LM Studio, and stores audit findings in PostgreSQL. Developer-first static analysis security auditor SAST with dual-pass skeptical AI false-alarm elimination. Traditional static security tools can flood engineering teams with false alarms, while running an entire repository through an LLM is costly, slow, and context-constrained. PuedoBot Core combines deterministic static analysis with intelligent AI verification: 1. Deterministic Speed : Pinpoints suspicious sinks using AST traversal, Bandit patterns, Semgrep security rules, OSV CVE advisories, and git commit history secret scans. 2. Dual-Pass AI Triage : Quarantines suspicious code snippets and evaluates them through a two-phase challenger pipeline — a Triage Scout assesses exploitability, followed by a Skeptical Verifier acting as a defense attorney to refute false alarms. 3. Bring Your Own AI : Connect ANY cloud LLM DeepSeek, OpenAI, Google Gemini, Groq, Mistral, OpenRouter or run 100% offline & private with local models Ollama, vLLM, LM Studio . - 🔍 Multi-Engine SAST Scanner : Simultaneously checks AST syntax patterns, Bandit security flaws, Semgrep rules, and OSV.dev dependency advisories in a single pass. - 🔑 Git History Secret Redaction : Detects exposed API keys, private certificates, and database secrets across active files and historical git commits with automatic regex redaction. - 🧠 Dual-Pass Skeptical AI Triage : - Pass 1 Exploitation Analysis : Traces data sources to sinks, identifies missing sanitizers, and estimates blast radius. - Pass 2 Challenger Refutation : Actively searches for framework protections, defensive guards, and dead code to eliminate false positives before presenting findings. - 🌐 Universal Model Compatibility : Completely model-agnostic. Plug in DeepSeek, OpenAI, Gemini, Groq, or self-host open-weights models Qwen 2.5 Coder, Llama 3, DeepSeek-R1 via Ollama or vLLM. - 💻 Rich Interactive CLI : Terminal dashboards with highlighted code proof dossiers, confidence scores, and review workflows. - 🔒 Privacy First & Air-Gapped Ready : When configured with local inference, zero code or tokens leave your environment. php flowchart TD A Target Codebase / Repository -- B Deterministic Engine subgraph Sinks "Multi-Engine Static Detection" B -- B1 Python AST Traversal B -- B2 Bandit Rules B -- B3 Semgrep Configs B -- B4 OSV Dependency CVEs B -- B5 Git Secret Scanner end Sinks -- C{Findings Detected?} C -- |No| D Clean Audit Report C -- |Yes| E Quarantined Code Context subgraph AI "Dual-Pass AI Verification Any LLM " E -- F Pass 1: Triage Scout