AI-Powered Penetration Testing and Vulnerability Remediation for GitHub Repositories

Abstract: AI-Powered Penetration Testing and Vulnerability Remediation for GitHub Repositories presents PentestAI, a web platform that scans a developer's GitHub repositories for security vulnerabilities, verifies the serious findings in an isolated sandbox and proposes fixes as pull requests. The system combines a Large Language Model (Google Gemini) that analyses the most security- relevant source files with a deterministic pattern-matching pass that detects committed secrets such as API keys and private keys.

High and critical findings are re-checked with CodeQL and Semgrep inside network isolated Docker containers to reduce false positives. A fixer service generates a patch with a code model, re-scans the patched code twice and opens a pull request only if the vulnerability is gone and no new issue is introduced. The application is built with TanStack Start, React and Supabase, and supports weekly automated scans, vulnerability lifecycle tracking, reports and an AI security assistant. The results show that the platform turns a manual, expensive security audit into a fast, repeatable and verifiable process for everyday developers.

Keywords: Penetration Testing, Large Language Models, Static Application Security Testing, Vulnerability detection, Secret Detection, Automated Program Repair, Sandboxing