Trepan: Local VS Code Security Auditor for AI-Generated Code
Trepan is a VS Code extension that addresses 'Silent AI Security Debt'—vulnerabilities in AI-suggested code that pass compilation but lack architectural security context. It acts as a local security gatekeeper between AI coding assistants and your codebase.
How Trepan Works
The tool uses a Zero-Baseline approach to audit AI suggestions against local security rules. It doesn't just guess; it enforces policies based on a .trepan/system_rules.md file in your project.
- 100% Local-Only: Uses Ollama to run security audits on your machine with no code leakage to external APIs
- Deterministic Validation: Forces the local LLM to validate suggested code against your specific security constraints before acceptance
- Context-Aware: Reads project-specific rules to catch logic-specific flaws that generic linters miss
What Trepan Catches
The tool is specifically tuned to find hallucinations that bypass standard static analysis:
- Insecure API endpoints suggested by AI
- Silent DOM XSS vulnerabilities in frontend logic
- Hardcoded secrets or "convenient" backdoors the AI might hallucinate
Technical Details
Trepan is open-source under AGPLv3 license and available in the VS Code Marketplace. The developer is experimenting with different system prompts for the auditing phase and seeking feedback on auditing logic and prompt engineering.
The developer is asking the community for input on which local models (Llama 3, Mistral, etc.) perform best for security-focused auditing without excessive latency.
📖 Read the full source: r/LocalLLaMA
👀 See Also
Qwen2-0.5B Fine-Tuned for Local Task Automation with llama.cpp
A developer fine-tuned Qwen2-0.5B for task automation using LoRA on ~1000 custom examples, creating a 300MB GGUF model that runs locally on CPU via llama.cpp. The model takes natural language tasks, detects task types, and generates execution plans with CLI commands and hotkeys.
Using Obliteratus toolkit to remove refusal weights from AI models
A Reddit user used the Obliteratus toolkit to surgically remove specific weights responsible for refusal behavior in AI models, demonstrating on Alibaba's Qwen 1.5B model that it can reveal training origins without retraining.
certctl: Self-hosted certificate lifecycle platform with 78 API endpoints for AI agent automation
certctl is a self-hosted certificate lifecycle platform built with Go and TypeScript that exposes 78 REST API endpoints for certificate management. The platform is issuer-agnostic and target-agnostic, with an MCP server planned to expose all functionality as native MCP tools.
LLMock: HTTP-based mocking server for deterministic LLM testing across processes
LLMock is a real HTTP server that mocks OpenAI, Claude, and Gemini APIs, allowing developers to run deterministic tests across multiple processes without hitting real APIs. It supports SSE streaming, tool calls, predicate routing, and request journaling with zero dependencies.