Shipped · Team of four · Backend architecture
SAST Vulnerability Management Platform
A security platform that scans repositories for leaked secrets, insecure code, and vulnerable dependencies, with LLM triage that cut false-positive review volume 40%.
- Go
- Supabase (PostgreSQL)
- Svelte
- Next.js
- TypeScript
Overview
What it does and whySecurity scanners bury the one real leak under hundreds of false positives, so teams learn to ignore them. I led backend architecture on a four-person team building a platform that treats triage as the product.
It runs secrets detection, static analysis, and dependency scanning in one containerized CI/CD pipeline, then has an LLM review each finding in context before a human sees it. In pre-release evaluation, that cut false-positive review volume by 40%.
Technologies
And why each one- Go
- The scanning backend. Cheap concurrency across repositories, and a single binary to containerize.
- Supabase (PostgreSQL)
- Findings, workspaces, and the audit trail, with row-level security separating tenants.
- Svelte
- The dashboard: a ranked queue of findings with severity and context.
- Next.js
- The public site and authenticated entry point.
- TypeScript
- Shared types across both frontends.
How it works
- 01
Three scanners, one pipeline
Secrets detection over full git history, static analysis over source, and dependency scanning all run as containerized CI/CD jobs on every push.
- 02
LLM triage before human review
Each finding is reviewed with its surrounding code. Test fixtures and dead keys get filtered; live issues get severity and a plain-language explanation.
- 03
Risk scoring, not just listing
Findings are ranked so the dashboard reads top-down: most exploitable first.
- 04
Audit trail by default
Every triage decision and status change is recorded, which is what compliance reviews ask for.
Curious about the details? I'm happy to walk through any of it.
The source for this project lives in a private repository and is available on request.