Have you ever wanted to scan your code for vulnerabilities without sending it to an external service? A lot of teams especially in fintech and regulated industries can’t risk their source code leaving their environment. But most security tools still require uploading code to the cloud. That’s why we built OffShield AI (@offshield_ai ) . It’s a privacy-first application security tool that runs locally. It finds issues like hardcoded secrets, weak crypto, SQL injection, and broken access control, then gives AI-assisted remediation suggestions all without your code leaving your machine. You also get: • A dashboard that shows your vulnerabilities and security score • AI remediation you can apply directly • The ability to push fixes to GitHub or GitLab from the tool Try the web tool: ide.offshield.tech Main site: offshield.tech

We are working on OffShield AI (@offshield_ai ), a security tool aimed at helping teams (especially in regulated environments like financial institutions) find vulnerabilities in their code without sending source code outside their environment. What the core engine does today Right now the First MVP is a local, on premises scanner. You upload a file or a zip of your code, and it runs a set of detection rules against it. In the current version it can already flag things like: Hardcoded secrets and API keys Weak cryptographic functions (e.g. MD5) Potential SQL injection patterns Simple IDOR-style patterns where client-supplied IDs are used directly Everything runs locally. The code never leaves the machine, this is intentional many organisations (especially banks) cannot send source code to a third-party SaaS scanner. About the UI The interface you see is temporary. It’s a clean, functional web UI so we can test the engine and the workflow. The design and user experience will be improved later. At this stage the focus is on the core scanning engine and the infrastructure that keeps everything local and private. AI remediation (next layer) Each finding is designed to include an AI-generated remediation suggestion. For privacy reasons this uses a local AI model via Ollama (running on the same machine). The model is pulled and executed locally so code and findings stay inside the environment. Right now, if Ollama isn’t running, the app still shows the vulnerability and clearly states that AI remediation is unavailable. Once Ollama is set up (ollama pull llama3.2), it will start giving practical fix suggestions in real time. Why this approach A lot of security tools either: Require sending code to the cloud, or Produce too much noise The goal with OffShield AI is accurate detection + clear remediation, while keeping the option to run fully on-premises. This first version is the foundation of that engine. Still early, but the core scanning path is working. Next steps are expanding the rules, tightening the AI remediation, and improving the interface. Happy to hear thoughts from people building in AppSec, DevSecOps, or working with regulated industries.

AI remediation (next layer) Each finding is designed to include an AI-generated remediation suggestion. For privacy reasons this uses a local AI model via Ollama (running on the same machine). The model is pulled and executed locally so code and findings stay inside the environment. Still taking time to install for the real testing, but yeah its going to come out well. Once Ollama is set up (ollama pull llama3.2), it will start giving practical fix suggestions in real time.