DEV Community
Follow
We Built a Security Scanner That Automates Itself — and Never Touches the Cloud
AI Security Studio offers a different approach to security analysis by running entirely locally, eliminating the need for code to leave the user's machine. This is crucial for sensitive data, NDAs, and proprietary codebases. The tool utilizes a local LLM and does not make external API calls or send telemetry. A key feature is the ASS Script engine, which allows for recording and replaying offline security scans.The scanning process prioritizes deterministic analysis before employing the LLM. It follows a pipeline starting with parsing, a rule engine for initial discovery, knowledge retrieval, summarization, and then LLM reasoning. The LLM operates on structured summaries, not raw code, to explain vulnerabilities and correlate findings.ASS Script, written in plain YAML, enables users to record workflows as a series of node interactions and scan calls. These scripts are readable and can be replayed identically from the GUI or command line. This record-once, replay-forever capability ensures consistent execution.For creating demo videos, AI Security Studio also employs an offline narration pipeline. This involves writing a shot list in markdown, which is then processed by a Python script. This script uses built-in macOS TTS for voice synthesis and ffmpeg for audio and subtitle generation.The entire narration generation process, including timed cues and subtitle creation, is performed locally without cloud dependencies. This aligns with the project's core philosophy of keeping data private. The pattern of prioritizing deterministic, local-first steps before relying on AI or network calls is highlighted as a valuable architectural principle.