I built an AI vulnerability scanner with Claude and Codex. It failed

Notifications You must be signed in to change notification settings

Fork 0

Star 2

Add this Action to an existing workflow or create a new one

View on Marketplace

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

664 Commits

664 Commits

.agent_governance

.agent_governance

.cargo

.cargo

.github

.github

.janitor

.janitor

crates

crates

docs

docs

overrides

overrides

rules/community

rules/community

tools

tools

.INNOVATION_LOG.md

.INNOVATION_LOG.md

.gitignore

.gitignore

.mailmap

.mailmap

.nojekyll

.nojekyll

.pre-commit-config.yaml

.pre-commit-config.yaml

CNAME

CNAME

Cargo.lock

Cargo.lock

Cargo.toml

Cargo.toml

Dockerfile

Dockerfile

LICENSE

LICENSE

README.md

README.md

SECURITY.md

SECURITY.md

SYSTEM_INSTRUCTIONS.md

SYSTEM_INSTRUCTIONS.md

action.yml

action.yml

demo.tape

demo.tape

deny.toml

deny.toml

flake.lock

flake.lock

flake.nix

flake.nix

index.html

index.html

janitor.toml

janitor.toml

justfile

justfile

mcp-manifest.json

mcp-manifest.json

mkdocs.yml

mkdocs.yml

rust-toolchain.toml

rust-toolchain.toml

Repository files navigation

v10.2.2 — Rust-Native. Zero-Copy. Dual-PQC Attestation. SLSA Level 4 Reproducible Builds.

*Attested by The Janitor v10.2.2

Research Foundation

For grant reviewers and academic collaborators: The Janitor implements three formally verified layers — IFDS interprocedural taint analysis across 23 language grammars, Kani-proven Boolean predicates for detection correctness, and Z3 SMT exploit witness synthesis. Full research brief: docs/grant-research-brief.md.

: Zero-Upload, FIPS 204 + FIPS 205 Compliant.*

Sonar finds style violations. The Janitor enforces structural integrity.

82% of open Godot Engine pull requests contain no issue link. 20% introduce language antipatterns. Zero comment scanners caught it. The Janitor did — across 50 live PRs, in under 90 seconds.

The Problem: Mythos-Class Autonomous Injection

The Veracode 2025 State of Software Security report established the baseline: AI-assisted code contains 36% more high-severity vulnerabilities than human-written equivalents. But the threat has evolved from Copilot assistance to 'Mythos-class' autonomous AI agents that inject vulnerabilities and orchestrate attack chains across microservices. Your linter passes agentic output. Your SAST tool uploads it to a cloud pipeline. By the time the report arrives, the PR is merged.

The threat model has changed. Your enforcement layer has not. The Janitor is the only deterministic defense against 'Mythos-class' AI agents, mathematically verifying intent before code enters the repository. Looking ahead, our decadal roadmap pioneers Zero-Knowledge AST proofs and Labyrinth Deception to neutralize adversarial agents at the structural level.

Researchers and grant reviewers: The Janitor's formal methods foundation — IFDS taint analysis, Kani-proven Boolean predicates, and Z3 SMT exploit witness synthesis — is documented in docs/grant-research-brief.md.

Zero-Friction GitHub Integration

Janitor Sentinel automatically downgrades vetoes when it detects safe patterns (e.g., Dependabot).

The Enforcement Layer

The Janitor is not a linter. It is a structural firewall that runs on your hardware, on every pull request — before the merge button is available.

Actuarial Risk Matrix

The Janitor doesn't just find vulnerabilities — it generates a financial ledger. Every intercepted threat is categorized and billed:

Critical Threat (security antipattern or Swarm collision): $150/incident — CI pipeline poisoned, supply-chain injection vector, or coordinated Agentic Swarm clone.

Necrotic GC (dead-code ghost, bot-closeable): $20/PR — automated garbage collection, no human triage required.

Total Economic Impact = sum of all categorical billings across the audit window.

Audited 33,000 PRs across 22 enterprise repositories on an 8 GB laptop. The ledger is machine-generated, per-PR, and appended to .janitor/bounce_log.ndjson atomically on every merge event.

Integrity Dashboard (WOPR)

janitor dashboard

Visualize C/C++ compile-time blast radius and track structural Swarm clones in real-time. The WOPR (War Operations Plan Response) dashboard renders the top-10 #include dependency silos ranked by transitive reach — the files whose modification ripples furthest through the compile graph. Built from in-memory libgit2 tree walks; no filesystem checkout required.

The Vibe-Check Gate

The Vibe-Check Gate compresses every patch blob via zstd and measures compressed_len / raw_len. Vibe-coded PRs — generated by prompting an AI without authoring the implementation — are statistically self-similar: the same scaffolding, the same docstring patterns, the same structural repetition. They compress below ratio 0.15. Any blob crossing that threshold triggers antipattern:ncd_anomaly (+10 points) before tree-sitter parses a single node.

Two complementary shields eliminate false positives on legitimate non-application content:

Null-Vector Collision Shield — IaC bypass (.nix, .lock, .json, .toml, .yaml, .yml, .csv) + 256-byte size guard + DOMAIN_VENDORED router. CVE vendor patches touching thirdparty/ score zero by construction. No legitimate infrastructure change can produce a spurious non-zero score.

Net-Negative Exemption — All score multipliers act exclusively on newly introduced symbols and patterns. Deletion-dominant patches — boilerplate purges, dead API removal, deprecated-code cleanup — mathematically cannot trigger any scoring signal. Score=0 is a proof, not a heuristic.

Zero-Copy Execution

Every analysis executes via memory-mapped file access. No network call is made during the dead-symbol pipeline.

Zero-Upload Guarantee — both deployment models:

Model Where analysis runs Source code leaves your environment?

CLI + GitHub Action (action.yml) Your GitHub Actions runner Never

Janitor Sentinel (GitHub App) Your GitHub Actions runner Never — Governor receives only the score

The Janitor engine runs entirely inside your own runner in both modes. The Governor (Sentinel's backend) receives a signed analysis result — not your source code. No server-side clone. No SAST upload.

Benchmark: Sustained 6.7 seconds per Pull Request on the 3.5M-line Godot Engine codebase (C++, C#, GDScript, Python) — featuring full Cross-File Taint Analysis and Wasm Governance. 58 MB peak RAM. On a standard CI runner. Zero panics.

Zombie Dependency Detection

AI generators hallucinate package imports. The Janitor scans package.json, Cargo.toml, requirements.txt, spin.toml, and wrangler.toml against the live symbol reference graph. A package that appears in your manifest but never appears in a reachable import path is a zombie dependency — flagged before merge.

Cryptographic Integrity Bonds

When a pull request clears the slop gate, Janitor Sentinel — our GitHub App — automatically issues a CycloneDX v1.6 CBOM (Cryptography Bill of Materials) for the merge event. The CBOM records every cryptographic operation performed during the scan: the Dual-PQC attestation signature (ML-DSA-65 NIST FIPS 204 + SLH-DSA NIST FIPS 205), the SHA-384 structural hashes, and the per-symbol audit entries covering {timestamp}{file_path}{sha256_pre_cleanup}. No token flag. No manual step. The proof is issued on a clean merge — a chain of custody for every line of code removed from production.

SLSA Level 4 Reproducible Builds

Every release binary is built with deterministic compiler flags (--build-id=none, LTO, single codegen unit) and verified via Docker-based dual-build comparison. The verify-reproducible recipe proves bit-for-bit identity across independent build environments — satisfying SLSA Build Level 4 for supply chain integrity.

Jira ASPM Deduplication

The Janitor integrates natively with Jira for Application Security Posture Management. Findings are synced as Jira issues with automatic deduplication — the first bounce creates a ticket; subsequent bounces with the same fingerprint skip creation. Credential preflight validates JANITOR_JIRA_USER and JANITOR_JIRA_TOKEN before attempting sync, gracefully degrading to local-only mode when credentials are absent.

Native SCM Support

Commit-status publishing works out of the box for GitHub, GitLab, and Azure DevOps. The Janitor auto-detects your CI environment and publishes pass/fail verdicts to the correct API — no additional configuration beyond standard CI tokens.

Competitive Moat

On-Device vs. Cloud Fabric

The market is filling with "AI Security Fabrics" — cloud-hosted LLM pipelines that ingest your source code, run probabilistic analysis, and return a verdict four minutes later. They are slow. They exfiltrate your code to a third-party inference cluster. Your diffs become training data.

The Janitor is the opposite architecture: an on-device structural firewall — a Rust binary that memory-maps your diffs, applies deterministic analysis, and exits. No network call during the analysis path. Proven at 6.7 seconds per Pull Request on a 3.5M-line C++ codebase, on an 8 GB laptop. Code never leaves your runner in either deployment model.

Deterministic vs. Heuristic

LLM-based code review tools cannot prove anything. They emit confidence scores against training distributions. A novel adversarial input — well-structured but semantically dangerous — is invisible to a heuristic system trained on pre-AI codebases.

The Janitor does not guess. It uses tree-sitter ASTs to prove structural identity, SHA-384 hashing to prove audit integrity, BLAKE3 to prove clone equivalence, and Dual-PQC (ML-DSA-65 FIPS 204 + SLH-DSA FIPS 205) to prove chain of custody. The gate passes or it blocks. There is no confidence interval. There is no false-positive budget. When a PR clears the gate, Janitor Sentinel issues a CycloneDX v1.6 CBOM: a cryptographically signed bond you can present to a SOC 2 auditor — not a report, a proof.

Air-Gap and Sovereign Deployment

Veracode, Checkmarx, and SonarQube require cloud connectivity. Their analysis pipelines send your source to remote clusters. For IL5/IL6 environments — classified networks, air-gapped DoD infrastructure, sovereign cloud mandates — this is a hard disqualifier.

The Janitor ships Air-Gap Intel Transfer Capsules: SHA-384-hashed, Ed25519-signed wisdom bundles that can be physically transported and cryptographically verified offline. Import a capsule, verify the signature chain, and the engine is operational with full threat intelligence — no network ever required.

Private Governance Modules (Wasm BYOR)

Veracode and Checkmarx enforce their rule sets. You cannot mount your own.

The Janitor supports Wasm BYOR (Bring Your Own Rules): private governance modules compiled to WebAssembly, fuel-bounded, memory-limited, and executed with deterministic provenance receipts. Every Wasm rule is pinned with BLAKE3 (janitor wasm-pin) and verified at load time. Every execution is sealed into the CBOM — auditable, reproducible, offline-verifiable.

Hallucinated Package Detection (Slopsquatting)

AI code generators hallucinate package names. py-react-vsc, django-tailwind-fast, node-express-secure-template — packages that do not exist in any registry but sound plausible enough to install if a threat actor registers them first.

The Janitor maintains a BLAKE3-seeded Bloom filter (SlopsquatFilter) seeded from the wisdom feed. Every package import in a PR is checked against the filter before it can reach the merge gate. Slopsquatting is stopped before it reaches production.

Replayable Decision Capsules

No tool in the SAST market can prove, offline and without network access, exactly why a PR was blocked. The Janitor can.

Every bounce decision is sealed into a DecisionCapsule — a

[truncated for AI cost control]