Codeminder

README excerpt

# codeminder 

Codeminder is a hybrid LLM-based SAST (Static Application Security Testing) tool. It combines the speed and precision of traditional pattern-based scanning with the deep, semantic understanding of Large Language Models to provide a comprehensive and actionable security analysis. This vibecoded app won 3rd place at [Gemini Vibe Code Hackathon – London](https://cerebralvalley.ai/e/vibe-code-gemini-london).

## Workflow

```mermaid
graph TD
    subgraph "Input"
        A[/"Project Folder"/]
    end

    subgraph "Phase 1: Parallel Static Analysis"
        direction LR
        A --> B(Scan code with Semgrep<br/>OWASP Top 10);
        A --> B1(Scan dependencies & IaC with Trivy);
        A --> C(Parse code with tree-sitter);
    end

    subgraph "Phase 2: Context Building"
        D(Build Dependency Graph);
        C --> D;
    end
    
    subgraph "Phase 3: AI-Powered Deep Analysis"
        I{"LLM Analysis Engine<br/>(Gemini 2.5 Pro)"}
    end

    subgraph "Phase 4: Reporting"
        J[Aggregate & Filter Findings];
        K[Generate Report];
        L[Actionable Insights];
    end

    B -- Semgrep Code Findings --> I;
    B1 -- Trivy Infra/Dependency Findings --> I;
    C -- Code Snippets --> I;
    D -- Dependency Context --> I;
    I --> J --> K --> L;

```

### Prerequisites

Before running Codeminder, you must have the Trivy binary installed on your system.

**macOS (using Homebrew):**
```bash
brew install aquasecurity/trivy/trivy
```

For other operating