AI-Powered Autonomous Security Bug Detection Tool

Post Views: 6

Open-source Autonomous Security Bug Hunter Unveiled

A recent project from SecureLayer7, a prominent offensive-security firm, has taken a novel approach to source code auditing. Dubbed Sandyaa, this open-source initiative leverages Large Language Models (LLMs) to scrutinize codebases, track data flows, and generate actionable exploit code for identified vulnerabilities.

The Tool’s Architecture

Sandyaa operates by accepting either a local directory or a Git URL, then running the audit end-to-end without requiring any interactive prompts. It constructs context across files, divides large codebases into manageable chunks based on code density and token budgets, and conducts recursive analysis passes to refine its findings.

Vulnerability Identification

Memory-safety bugs: use-after-free, buffer overflow, type confusion, double-free
Logic bugs: authentication bypass, TOCTOU, state machine errors
SQL, Command, XSS, SSRF, path traversal
Cryptographic misuse
Concurrency races
Integer overflow and signedness issues
Unsafe APIs: deserialization, XXE, prototype pollution

Execution and Safety

Sandyaa can execute the generated proof-of-concept code to confirm exploitability. However, this feature is gated by default, and PoC execution is optional.

Requirements and Availability

Sandyaa requires Node.js 18 or newer, git, and a logged-in Claude Code installation. It is available for free on GitHub.

“Sandyaa represents a significant advancement in source code auditing, leveraging LLMs to streamline the process and empower developers to focus on refining their code.” – Sandeep Kamble, CTO at SecureLayer7