GuardPR AI

Overview

GuardPR AI is a production-style DevSecOps GitHub App that automatically reviews pull requests for security issues. It runs Semgrep, Gitleaks and optional container/IaC scanners, then uses AI-assisted triage with OWASP mapping and remediation guidance.

Problem or Opportunity

Security review often happens late in the delivery cycle, and manual PR inspection is inconsistent, time-consuming and easy to miss under delivery pressure.

Proposed Solution

GuardPR AI integrates directly into GitHub workflows to scan each pull request, prioritise findings, post actionable comments and enforce configurable policy gates through a dedicated dashboard.

Key Capabilities

• Automated PR security scanning with Semgrep and Gitleaks
• Optional container and infrastructure-as-code scanning
• AI-assisted finding triage with OWASP mapping
• PR comment generation and policy gate enforcement
• Scan history and dashboard in React + TypeScript
• Background processing with Celery and PostgreSQL

Architecture and Workflow

A FastAPI backend handles GitHub webhooks, orchestrates scan jobs via Celery workers, stores results in PostgreSQL and serves a React dashboard for review, configuration and reporting.

Security Considerations

• Webhook signature verification for GitHub events
• Least-privilege GitHub App permissions
• Isolated scan execution in containerised workers
• Sensitive finding data handled with access controls

Challenges and Decisions

• Balancing scan depth with PR feedback turnaround time
• Reducing false positives while keeping coverage meaningful
• Designing remediation guidance that developers can act on quickly