DEV Community 59m ago

I built a Mac AppSec tool where the AI never sees your whole repo

I Built a Mac AppSec Tool Where the AI Never Sees Your Whole Repo

Most AppSec pipelines assume one thing first: upload the repo. That breaks for NDA client code, regulated workloads, or a policy that source does not leave the building. SaaS scanners want the tree. On-prem enterprise gear assumes you have a security department. A lot of solo founders and small teams sit in the gap. I built InsurStaq - a local-first security auditor for macOS (Apple silicon) - to sit in that gap.

The Order of Operations Matters

The product is deliberately not LLM over the repo. The loop is:

Parse and map the application - routes, auth, frameworks via tree-sitter adapters.
Run deterministic scanners - first-party SAST, secrets (including git history), IaC / container / CI checks, offline OSV CVEs, SBOM export.
Build a code + security graph and trace source→sink attack paths (inter-procedural taint), not only rule hits.
Feed a local model an evidence packet - explain, triage, draft a minimal patch.
You approve → atomic apply → rescan to verify.

The model never gets the whole repository as context. Scanners find; the model reasons over a bounded packet with schema-validated output. That keeps it grounded and small enough for a laptop (bundled llama.cpp sidecar, or your own Ollama / LM Studio on loopback).

Privacy Is Structural, Not a Checkbox

One allowlisted outbound gateway with a ledger; request types that must not carry repo content do not.
Air-Gapped Mode turns networking off.
Encrypted local store + Keychain.
Read-only Git via vendored libgit2 (no hooks/filters, no fetch/push).

What It Is / Is Not

Is: local SAST-style coverage + attack-path tracing + approval-gated remediation + compliance readiness mapping (OWASP / ASVS / CWE / SOC 2 / ISO 27001 / PCI / GDPR / HIPAA as evidence states, not badges).

Is not: a penetration test. Not a certification.

Early Access, Reports, and CLI

Early access is available via licence + download by email. Framework coverage is uneven - I'd rather hear what you need than overclaim.

Reports come in PDF, HTML, Markdown, JSON, SARIF, CSV. The CLI can fail CI on critical findings.

I built a Mac AppSec tool where the AI never sees your whole repo