🛡️ RepoShield-AI: Multi-Repo Security Scanner

RepoShield-AI is a powerful, deterministic security analysis engine designed to identify malicious patterns, exposed secrets, and risky code execution in GitHub repositories. Built with a "Safety First" philosophy, it performs deep static analysis without ever executing a line of third-party code.

🆕 Now with GitHub Authentication & Premium Private Repository Scanning!

✨ Key Features

Security Analysis

🚀 Instant Analysis: Just paste a GitHub URL and get a detailed security report in seconds.
🔍 AST-Powered Detection: Go beyond simple regex. Our Python analyzer uses Abstract Syntax Trees to distinguish between benign strings and dangerous calls.
🛡️ Noise-Cancellation: Intelligent heuristics specifically tuned for MERN stack and modern frontend projects (skips SVGs, bundled assets, and minified noise).
🔑 Secret Scanning: High-entropy detection for AWS keys, GitHub tokens, and custom API patterns.
📉 Weighted Scoring: A behavior-aware scoring engine that prioritizes dangerous capability over simple warnings.

Authentication & Access Control 🆕

🔐 GitHub OAuth Integration: Secure login with your GitHub account
🎯 Smart Access Control: Public repos scan for free, private repos require authentication
👑 Premium Subscriptions: Unlock private repository scanning with Premium
💳 Dodo Payments Integration: Seamless payment processing for Premium plans
🔒 JWT Authentication: Secure token-based authentication with refresh tokens

User Experience

🌓 Modern UI: A sleek, dark-mode-ready React interface with real-time scan states and actionable findings.
👤 User Profiles: View your account info, premium status, and payment history
⚡ Real-time Feedback: Progress indicators and status updates during scans

📊 SWOT Analysis

Strengths 💪

🎯 Zero-Execution Security: Complete static analysis without running any third-party code, eliminating execution risks
🧠 AST-Powered Intelligence: Advanced Abstract Syntax Tree analysis for accurate detection beyond simple pattern matching
🔐 Enterprise-Grade Authentication: Robust GitHub OAuth + JWT implementation with secure token management
💎 Premium Monetization: Integrated payment system (Dodo Payments) with subscription management
🎨 Modern Tech Stack: Built with Python 3.11+, React 19, Vite, and Tailwind CSS for optimal performance
📚 Comprehensive Documentation: Detailed guides for architecture, scoring, philosophy, and implementation
🛡️ Multi-Layer Analysis: Combines obfuscation detection, secret scanning, static code analysis, and CI/CD security checks
⚡ Instant Results: Fast analysis with real-time feedback and progress indicators
🎯 Context-Aware: Intelligent filtering for MERN stacks, frontend projects, and common false positives

Weaknesses 🔍

🌐 Language Limitation: Currently focused on Python; limited support for TypeScript, Go, Rust, and other languages
🔄 No Dynamic Analysis: Static-only approach may miss runtime vulnerabilities and behavior-based threats
📊 No Historical Tracking: Lacks scan history and trend analysis for repositories over time
👥 Single-User Focus: No team collaboration features or multi-user workspace support
⚠️ Potential False Positives: Despite noise-cancellation, complex codebases may still trigger some false alerts
🔌 Limited Integrations: No webhook support or CI/CD pipeline integration yet
📈 Scalability Unknown: Performance on extremely large repositories (100k+ files) not yet tested
🌍 No Multi-Language UI: Interface currently available only in English

Opportunities 🚀

🌐 Multi-Language Expansion: Add support for JavaScript/TypeScript, Go, Rust, Java, C++, and other popular languages
🤖 ML Enhancement: Integrate machine learning for pattern recognition and predictive security analysis
🔗 CI/CD Integration: GitHub Actions, GitLab CI, Jenkins plugins for automated scanning
📊 Analytics Dashboard: Historical trends, vulnerability tracking, and security score evolution
👥 Enterprise Features: Team workspaces, role-based access control, and compliance reporting
🌍 Global Expansion: Multi-language UI support and localization
📱 Mobile App: iOS/Android apps for on-the-go security monitoring
🔌 API Marketplace: Public API for third-party integrations and custom workflows
🎓 Educational Platform: Security training modules and best practices guides
🏢 White-Label Solution: Customizable branding for enterprise clients

Threats ⚠️

🏆 Established Competitors: GitHub Advanced Security, Snyk, SonarQube with larger market share
🆓 Free Alternatives: Open-source tools like Bandit, Semgrep, and GitGuardian
🔄 Rapid Tech Evolution: New attack vectors and obfuscation techniques emerging constantly
💰 Market Saturation: Crowded security tools market with high customer acquisition costs
🔐 Privacy Concerns: Users may be hesitant to grant repository access to third-party services
⚖️ Compliance Requirements: GDPR, SOC 2, and other regulations requiring significant investment
🚀 GitHub Native Features: GitHub expanding built-in security features (Dependabot, CodeQL)
💸 Economic Downturn: Reduced security budgets affecting premium subscription adoption
🔧 Maintenance Burden: Keeping up with GitHub API changes and new language versions

🔄 Static Analyzer Architecture Flowchart

┌─────────────────────────────────────────────────────────────────────────────┐
│                          USER INTERACTION LAYER                              │
│                                                                              │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │                     React Frontend (Vite + Tailwind)                  │  │
│  │  • GitHub URL Input                                                   │  │
│  │  • OAuth Login Button                                                 │  │
│  │  • Real-time Progress Display                                         │  │
│  │  • Results Visualization                                              │  │
│  └────────────────────────────┬─────────────────────────────────────────┘  │
└────────────────────────────────┼────────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                         AUTHENTICATION LAYER                                 │
│                                                                              │
│  ┌──────────────────┐      ┌──────────────────┐      ┌─────────────────┐  │
│  │  GitHub OAuth    │─────▶│   JWT Manager    │─────▶│  Access Control │  │
│  │  • State CSRF    │      │  • 15min Access  │      │  • Public: Free │  │
│  │  • Code Exchange │      │  • 7day Refresh  │      │  • Private: $$  │  │
│  └──────────────────┘      └──────────────────┘      └─────────────────┘  │
└────────────────────────────────┬────────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                          API GATEWAY (Flask)                                 │
│                                                                              │
│  POST /scan ────▶ Validate URL ────▶ Check Access ────▶ Queue Analysis     │
│                      │                    │                    │             │
│                      ▼                    ▼                    ▼             │
│                 Repo Public?         User Premium?      Start Scan Job      │
└────────────────────────────────┬────────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                        REPOSITORY CLONING LAYER                              │
│                                                                              │
│  ┌───────────────────────────────────────────────────────────────────────┐ │
│  │                    Git Subprocess Manager                              │ │
│  │  • Shallow Clone (--depth 1)                                          │ │
│  │  • No Tags (--no-tags)                                                │ │
│  │  • 300s Timeout                                                       │ │
│  │  • Temp Directory Isolation                                           │ │
│  │  • GitHub Token Injection (if private)                                │ │
│  └───────────────────────────────┬───────────────────────────────────────┘ │
└────────────────────────────────┼────────────────────────────────────────────┘
                                 │
                                 ▼
┌─────────────────────────────────────────────────────────────────────────────┐
│                      STATIC ANALYSIS ORCHESTRATOR                            │
│                                                                              │
│  ┌──────────────────────────────────────────────────────────────────────┐  │
│  │                      File Discovery Engine                            │  │
│  │  • Recursive Directory Walk                                           │  │

Reposhield

Install / Use

README