VulnViper

VulnViper is an advanced security auditing tool explicitly designed for Python codebases, utilizing the capabilities of Large Language Models (LLMs) like OpenAI's GPT series and Google's Gemini. This intelligent tool streamlines the process of identifying and understanding potential vulnerabilities in code, offering developers critical insights and actionable recommendations for securing their applications.

Key Features

• LLM-Powered Analysis: Harnesses cutting-edge LLMs for comprehensive vulnerability detection and code understanding.
• Comprehensive Audits: Detects a wide spectrum of security issues, transcending basic Common Weakness Enumeration (CWE) lists.
• Actionable Recommendations: Delivers pertinent suggestions to resolve identified security concerns.
• Code Summaries: Creates concise summaries of code chunks for enhanced clarity.
• User-Friendly Interfaces: Offers both a Command-Line Interface (CLI) for automation and a Graphical User Interface (GUI) for intuitive interaction.
• Flexible Configuration: Users can specify their preferred LLM provider and model for tailored analysis.
• Local Data Storage: All scan results are securely stored in a local SQLite database for easy retrieval.
• Markdown Reporting: Generates detailed audit reports in an easy-to-read Markdown format, ensuring clarity in findings.
• Dynamic Naming: Report files are automatically named based on the scanned folder for easy identification.
• Progress Tracking: Visual indicators of progress in the GUI and status updates in the CLI keep users informed during scans.

How It Works

VulnViper employs a multi-stage process to analyze Python code effectively:

1. Code Discovery & Parsing: The tool identifies all .py files in the targeted directory and converts them into Abstract Syntax Trees (AST) to facilitate deeper code comprehension.

2. Intelligent Chunking: Logical units of code, such as functions and classes, are identified, with larger chunks further split into manageable sub-chunks, ensuring that LLM input limits are respected while retaining logical coherence.

3. LLM-Powered Audit: Specialized prompts are constructed to query the LLM for each code sub-chunk, focusing on summarizing the code, identifying vulnerabilities, and providing mitigation recommendations.

4. Data Storage & Reporting: Analysis results are stored in an SQLite database and compiled into a detailed Markdown report, available for review post-scan.

Tech Stack

• Programming Language: Python 3.9 or higher
• Large Language Models: Integrates with OpenAI and Google Gemini APIs
• GUI Framework: Utilizes Flet for building the GUI
• Data Storage: SQLite for storing scan results

Usage

VulnViper can be used via:

• Command-Line Interface (CLI): For scriptable interactions and automation within CI/CD pipelines.
• Graphical User Interface (GUI): For users seeking an easy and visual way to configure scans and view results.

Output

Upon completion of scans, VulnViper generates two key outputs:

• An SQLite database containing all analysis details.
• A comprehensive Markdown report detailing findings, vulnerabilities, and recommendations.

Contribution to the Project

Contributions are encouraged to enhance VulnViper's capabilities, including improvements to LLM prompts, GUI features, and reporting formats. For those interested in contributing, more details can be found in the project's CONTRIBUTING guide.

Disclaimer

VulnViper is designed to assist in security auditing but should not replace manual code reviews by security professionals. All findings should be assessed critically as part of a broader security strategy.