AI-OWASP-Code-Scanner

# 🛡️ AI OWASP Code Review Assistant

An intelligent, completely free, offline-first Code Review Assistant designed to scan Python, Java, and JavaScript applications for OWASP Top 10 vulnerabilities. It utilizes an offline regex-based Static Application Security Testing (SAST) engine to identify vulnerabilities, and integrates with the Google Gemini API (model `gemini-3.6-flash`) to generate contextual, secure coding recommendations and refactored code snippets.

---

## ✨ Features

* **Multi-Language Support:** Scans Python, Java, and JavaScript source code.
* **Offline SAST Engine:** Instantly flags common OWASP Top 10 vulnerabilities (Injection, XSS, Hardcoded Secrets, Insecure Deserialization, etc.) using lightweight, fast regex rules.
* **AI-Powered Remediation:** Connects to `gemini-3.6-flash` to explain *why* a snippet is vulnerable and provides the exact code to fix it.
* **Privacy-First Workflow:** Code is only sent to the AI if you explicitly click the "Generate AI Fix" button for a specific finding.
* **Interactive UI:** Built on Streamlit for a fast, responsive developer experience.

---

## 🚀 Getting Started (Windows 10 / VS Code)

### Prerequisites

* Python 3.13 or 3.14 installed on your Windows machine.
* Visual Studio Code.
* A free Google Gemini API Key.

### Installation

1. **Clone the repository:**
```bash
git clone https://github.com/JuttSahib1999/AI-OWASP-Code-Scanner.git
cd AI-OWASP-Code-Scanner

```


2. **Create and activate a virtual environment:**
* Using Python 3.14:
```powershell
py -3.14 -m venv venv
.\venv\Scripts\activate

```


* Or using Python 3.13:
```powershell
py -3.13 -m venv venv
.\venv\Scripts\activate

```




3. **Install the dependencies:**
```powershell
pip install -r requirements.txt

```


4. **Configure your API Key:**
Rename `.env.example` to `.env` and insert your Gemini API Key:
```env
GEMINI_API_KEY="your_actual_api_key_here"

```


5. **Run the Application:**
```powershell
streamlit run app.py

```


The application will open in your default browser at `http://localhost:8501`.

---

## Screenshots

### Application Dashboard & File Upload Interface
![AI OWASP Code Review Assistant - Dashboard](screenshots/main_interface.png)

---

### Static Vulnerability Scanning & AI Remediation Analysis
![AI OWASP Code Review Assistant - Scan Results & AI Fix](screenshots/test_insecure_java.png)

---

## 👨‍💻 Author

Created by **Abdul Muqeet Tabraiz**

* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the MIT License - see the `LICENSE` file for details.