Team of four · Backend architecture
SAST Vulnerability Management Platform
An AI-assisted security platform that scans repositories for leaked secrets, insecure code, and vulnerable dependencies, then triages what it finds.
- Go
- Supabase (PostgreSQL)
- Svelte
- Next.js
- TypeScript
Overview
What it does and whySecurity scanners bury the one real leak under hundreds of false positives, so teams learn to ignore them. I led backend architecture on a four-person team building a platform that treats triage as the product.
It runs secrets detection, static analysis, and dependency scanning in one containerized CI/CD pipeline, then has an LLM review each finding in context before a human sees it. In pre-release evaluation, that cut false-positive review volume by 40 percent.
Technologies
And why each one- Go
- The scanning backend. Cheap concurrency across repositories, and a single binary to containerize.
- Supabase (PostgreSQL)
- Findings, workspaces, and the audit trail, with row-level security separating tenants.
- Svelte
- The dashboard: a ranked queue of findings with severity and context.
- Next.js
- The public site and authenticated entry point.
- TypeScript
- Shared types across both frontends.
How it works
- 01
Three scanners, one pipeline
Secrets detection over full git history, static analysis over source, and dependency scanning all run as containerized CI/CD jobs on every push.
- 02
LLM triage before human review
Each finding is reviewed with its surrounding code. Test fixtures and dead keys get filtered; live issues get severity and a plain-language explanation.
- 03
Risk scoring, not just listing
Findings are ranked so the dashboard reads top-down: most exploitable first.
- 04
Audit trail by default
Every triage decision and status change is recorded, which is what compliance reviews ask for.
Context
Background reading- OWASP: Source Code Analysis Tools What static analysis can catch, including the false-positive problem this project is built around.
- GitHub: About secret scanning Why scanning full git history matters, not just the latest commit.
- OWASP Dependency-Check The reference approach to matching dependencies against known CVEs.
Curious about the details? I'm happy to walk through any of it.
The source for this project lives in a private repository and is available on request.