Skip to content

Add VulnHawk - AI-powered code security scanner#1801

Open
momenbasel wants to merge 4 commits intoanalysis-tools-dev:masterfrom
momenbasel:add-vulnhawk
Open

Add VulnHawk - AI-powered code security scanner#1801
momenbasel wants to merge 4 commits intoanalysis-tools-dev:masterfrom
momenbasel:add-vulnhawk

Conversation

@momenbasel
Copy link
Copy Markdown

@momenbasel momenbasel commented Apr 8, 2026

What is VulnHawk?

I built VulnHawk to bridge the gap between pattern-matching SAST tools (Semgrep, CodeQL) and manual code review. Traditional scanners are great at finding known vulnerability patterns, but they struggle with business logic flaws -- things like inconsistent authorization across related endpoints, or subtle IDOR issues where object ownership checks are applied in some handlers but not others.

VulnHawk uses LLMs to actually understand what the code is doing: it cross-references auth patterns across endpoints, traces data flows through business logic, and flags inconsistencies that a regex-based approach would never catch.

Languages

Python, JavaScript/TypeScript, Go, Java, PHP, Ruby

Distribution

  • CLI: pip install vulnhawk (PyPI)
  • GitHub Action: available on the Actions Marketplace
  • LLM backends: works with Claude and OpenAI APIs, but also supports Ollama for fully local/private scanning
  • Output: JSON, SARIF, Markdown -- the SARIF output means you can feed results from other tools into VulnHawk to enrich the analysis, or pipe VulnHawk findings into your existing SARIF dashboard
  • License: MIT

Why add it here?

There are plenty of SAST tools on this list already, but very few that use AI to reason about code semantics rather than matching syntax patterns. VulnHawk fills that niche -- it is specifically designed to catch the classes of vulnerabilities that slip through conventional static analysis.

Checklist

  • Tool is actively maintained (multiple contributors)
  • Added as YAML file in data/tools/vulnhawk.yml
  • Description under 500 characters
  • License specified (MIT)
  • Homepage field included
  • Relevant tags added (python, javascript, typescript, go, java, php, ruby, security)

VulnHawk is an AI-powered code security scanner (Python, MIT licensed)
that uses LLMs to understand business logic and detect vulnerabilities
like missing auth checks, IDOR flaws, and logic bugs. Supports Python,
JavaScript/TypeScript, and Go. Multiple LLM backends (Claude, OpenAI,
Ollama). Output formats: JSON, SARIF, Markdown.
Copilot AI review requested due to automatic review settings April 8, 2026 21:53
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new tool definition for VulnHawk to the repository’s static analysis/tools catalog so it can be rendered/consumed alongside existing linters and security scanners.

Changes:

  • Introduces data/tools/vulnhawk.yml describing VulnHawk (categories, tags, license, types, source, description).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +11 to +14
types:
- cli
source: 'https://github.com/momenbasel/vulnhawk'
description: >-
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

homepage appears to be a required field for tool entries (the renderer’s Entry/ParsedEntry structs require it). This new tool file only sets source, so CI/rendering will likely fail to deserialize the YAML. Add a homepage: URL (can be the project website or reuse the GitHub repo URL if there isn’t a separate homepage).

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants