Show HN: PuedoBot, an OSS security auditor that tries to disprove its findings (github.com)

PuedoBot, an open-source static analysis security auditor, has been launched to address the challenge of false alarms prevalent in traditional security tools. Unlike existing solutions that often overwhelm developers with irrelevant alerts, PuedoBot utilizes a dual-pass AI approach for more precise results. The core functionality combines deterministic static analysis with sophisticated AI verification, allowing it to not only detect potential security vulnerabilities through various scans but also provide a skeptical analysis that effectively reduces false positives. This dual-pass system comprises a Triage Scout for assessing exploitability and a Skeptical Verifier, working collaboratively to challenge findings before presenting a clean audit report. The tool is flexible, supporting multiple AI models—either cloud-based or local—ensuring privacy and versatility in different deployment environments. With features like Git history secret detection and an interactive command-line interface, PuedoBot is poised to enhance security auditing in software development by promoting more reliable assessments that integrate seamlessly into CI/CD pipelines, making it a significant addition to the AI/ML community's toolkit for proactive security measures.