{"slug": "we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud", "title": "We Built a Security Scanner That Automates Itself — and Never Touches the Cloud", "summary": "AI Security Studio has built a fully offline security scanner automation engine, ASS Script, that records and replays GUI workflows and scans without sending code to the cloud. The engine uses deterministic parsing and rule-based analysis first, with local LLMs only reasoning over structured summaries, and the team also developed an offline pipeline to generate narrated, subtitled demo videos using local TTS and ffmpeg.", "body_md": "How AI Security Studio's ASS Script engine lets you record, replay, and narrate a full offline security scan — deterministic analysis first, local LLM reasoning second.\n\nMost \"AI-powered\" security tools have the same dependency: your code has to leave your machine to get an answer. That's a non-starter for a lot of security research — client engagements under NDA, regulated codebases, or just not wanting proprietary source sitting in someone else's inference logs.\n\nAI Security Studio is built the other way: **everything runs locally.** Local LLM (Ollama / llama.cpp / LM Studio), no external API calls, no telemetry. This post walks through one specific piece of it — the automation engine we call **ASS Script** — and the small offline pipeline I built on top of it to generate narrated, subtitled walkthrough videos without touching a cloud TTS API either.\n\nBefore any AI touches a finding, it goes through:\n\nParser → Rule Engine → Knowledge Retrieval → Summarization → LLM → Reasoning → Finding → Report\n\nStatic parsing (Roslyn / Tree-sitter) and a deterministic rule engine — secret detection, header analysis, JWT validation, SQLi/XSS pattern matching — do the actual discovery. The LLM never sees raw source. It only reasons over structured summaries the rule engine already produced: explaining *why* something is a bug, correlating findings, drafting the writeup. If the evidence isn't solid, the system is designed to say \"needs manual verification\" rather than invent a conclusion.\n\nASS Script (AI Security Studio Automation Script) is an iMacro-style record/play/edit engine built on the same node-graph designer used elsewhere in the app. Scripts are plain YAML — readable and diffable, not an opaque macro blob:\n\n```\nyaml\nnodes:\n  - id: \"n5\"\n    kind: \"GuiInteract\"\n    title: \"Click Find bugs on this URL\"\n    notes: \"Imports the URL as a one-host scope. Scope import only — sends no network traffic by itself.\"\n    parameters:\n      control: \"ScanUrlButton\"\n      action: \"click\"\n  - id: \"n9\"\n    kind: \"GuiInteract\"\n    title: \"Click Scan All\"\n    notes: \"Kicks off the panel's real passive sweep — genuinely live crawl traffic, same as a human operator would trigger.\"\n    parameters:\n      control: \"ScanAllButton\"\n      action: \"click\"\n  - id: \"n14\"\n    kind: \"RunScan\"\n    title: \"Live source scan\"\n    notes: \"Runs the real ScanService against the target's own source directory — footage shows a real scan, not a mockup.\"\n    parameters:\n      path: \"/path/to/target/source\"\nEach node is a real GUI action or a real scan/analyzer call — no simulated steps. You record a workflow once, then replay it identically from the GUI or the CLI (workflow run some-script.adrflow.yaml).\n\nThe fun side quest: offline narration for the demo videos\nWe wanted walkthrough videos with voiceover and subtitles, but the \"generate subtitles\" step usually means uploading video/audio to a cloud transcription or TTS API — which would be a little embarrassing for a project whose whole pitch is \"nothing leaves your machine.\"\n\nSo the pipeline is: write the shot list as a markdown table (beat / timecode / on-screen action / caption / VO line), then run it through a small Python script that:\n\nParses the table into timed cues\nSynthesizes each VO line with macOS's built-in say (fully offline TTS)\nMeasures each clip's real duration with ffprobe\nConcatenates them into one narration track with ffmpeg\nEmits a .srt timed to the actual synthesized audio, not a guess\nFlags any beat where the narration runs longer than the video's planned window, so you know exactly where to hold a shot longer\nThe output is a narration.wav + captions.srt pair generated entirely from tools already on the machine — no API keys, no cloud dependency, same philosophy as the scanner itself.\n\nWhy this matters beyond the demo video\nThe pattern generalizes: treat the LLM/AI step as optional and swappable, put the deterministic and local-first parts first. It's true for the security pipeline (rule engine before LLM) and it turned out to be just as true for the tooling around the project (offline TTS before cloud TTS). If your architecture assumes \"AI\" every time it actually means \"network call,\" that's worth questioning.\n```\n\n", "url": "https://wpnews.pro/news/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud", "canonical_source": "https://dev.to/jomynn/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud-48h6", "published_at": "2026-08-18 07:51:55+00:00", "updated_at": "2026-08-18 08:13:13.524151+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-safety"], "entities": ["AI Security Studio", "ASS Script", "Ollama", "llama.cpp", "LM Studio", "Roslyn", "Tree-sitter"], "alternates": {"html": "https://wpnews.pro/news/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud", "markdown": "https://wpnews.pro/news/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud.md", "text": "https://wpnews.pro/news/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud.txt", "jsonld": "https://wpnews.pro/news/we-built-a-security-scanner-that-automates-itself-and-never-touches-the-cloud.jsonld"}}