LocalAudit：完全在本機執行的 AI 原始碼安全審計工具
LocalAudit: an AI security auditor that never sees your secrets and never leaves your laptop
LocalAudit 是一款完全在本機執行的命令列原始碼安全審計工具，以確定性規則檢查硬編碼密鑰、注入風險、不安全設定及未鎖定版本的依賴項。工具會輸出 HTML、JSON 和 Markdown 報告，列出檔案與行號、問題説明及修正方法；本地開放權重模型負責解釋問題、判斷誤報可能性並撰寫修正方案，模型無法使用時仍會產生完整報告。
LocalAudit is a command-line security auditor for source code that runs 100% on your own machine. Point it at a repo and a few seconds later you get a clean HTML report (plus JSON and Markdown) listing hardcoded secrets, injection risks, insecure configuration and unpinned dependencies. Each finding comes with the file and line, the code around it, a plain-English explanation and a concrete fix.
The design rule I cared most about: the LLM never detects anything. Deterministic rules find the issues: 24 code-pattern rules for Python/Django/Flask and JavaScript/Node, 10 built-in secret detectors (AWS, Stripe, Slack, GitHub, Google, JWTs, private keys, high-entropy strings...) and dependency checks. A local open-weight model then triages each finding. It explains it, judges whether it's likely a false positive in context, and writes a fix. If the model is unavailable, you still get the full report.
Who would pay for this? People who need a security pass on code they aren't allowed to upload anywhere:
For all of them, the cloud AI code-review tools have the same problem: your client's source code goes to someone else's server. LocalAudit's answer is that it doesn't go anywhere.
The demo scans the bundled examples/vulnerable_app, a deliberately insecure Django + Node app full of fake credentials. The rules-only scan takes about a second and finds 43 issues (4 critical, 16 high), for a risk score of 100/100. A few things worth watching for:
Useful flags: --no-llm, --min-severity high, --max-llm-findings 10, --model <any Ollama model>, and --fail-on high (exits with code 1, for CI).
The stack is deliberately small: Python 3.10+, requests, jinja2 and pytest, with 110 tests. Those tests include a mocked Ollama covering invalid JSON, timeouts and the server going down mid-run.
I built it with an AI coding agent (Claude Code) doing much of the implementation while I directed the design and reviewed the results. One moment I liked: testing caught a regex bug where a bare password = "..." wasn't detected. Because the masker only masks what the detector finds, that password was showing up unmasked as a context line in a neighbouring finding's snippet. It's fixed now, and there's a regression test for it.
For this product, open weights aren't a nice-to-have. They're the reason it can exist.
來源：DEV Community · dev.to