SecureCodeReview

An AI-powered code review framework with multi-LLM support for GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI, Bitbucket, and Drone CI.

Features

Core Features

• Multi-LLM Support: OpenAI (GPT-4), Google Gemini, Claude, Ollama, and extensible to any provider
• Multi-Language Analysis: Python, JavaScript, TypeScript, Java, C++, C, Go, Rust
• Security-First Design: PII detection, credential protection, no data leakage
• CI/CD Integration: Native support for all major CI/CD platforms
• Plugin Architecture: Adapter pattern for easy LLM provider extension

Phase 3 Features (Latest)

• 🔍 Diff-Based Analysis: Review only changed code (99%+ token reduction vs full repo)
• 🔐 Secret Detection & Masking: Automatically detect API keys, tokens, credentials, PII before LLM
• ✅ Man-in-the-Loop Approval: RED (critical) vs YELLOW (suggestions) workflow - humans always approve
• 📊 Multi-Format Output: JSON, Markdown, HTML (interactive), Text formats
• ⚙️ Severity Filtering: Focus on critical/high/medium/low/info issues
• 📈 Metrics & Analytics: Completion rates, issues per file, severity breakdown
• Git Integration: Auto-extract diffs from git branches, track commit info

Installation

pip install securereview

From Source

git clone https://github.com/yourusername/securereview.git
cd securereview
pip install -e .

Development Setup

pip install -e ".[dev,security]"

Quick Start

Local Review (No API Key Required)

# Using Ollama locally
securereview --repo-path . --local

# With HTML output (interactive report)
securereview --repo-path . --local --output html

Cost-Efficient Diff-Based Review

# Review only changes since main branch (90%+ cost savings)
securereview --repo-path . --local --git-diff main

# Or from a saved diff file
git diff origin/main > changes.diff
securereview --repo-path . --local --diff-file changes.diff

# Filter by severity to focus on critical issues
securereview --repo-path . --local --git-diff main --severity critical

With Approval Workflow

# Requires human approval for critical issues (RED findings)
securereview --repo-path . --local --require-approval

# Secrets are automatically detected and masked before LLM
# (This is default - use --no-mask-secrets to disable)

Output Formats

# JSON output (machine-readable)
securereview --repo-path . --local --output json > report.json

# Markdown output (for documentation)
securereview --repo-path . --local --output markdown > report.md

# HTML output (interactive, downloadable)
securereview --repo-path . --local --output html

# Text output (human-readable)
securereview --repo-path . --local --output text

Cloud LLM Providers

# OpenAI GPT-4
securereview --repo-path . --llm-provider openai --api-key $OPENAI_API_KEY

# Google Gemini
securereview --repo-path . --llm-provider gemini --api-key $GEMINI_API_KEY --llm-model gemini-pro

# Anthropic Claude
securereview --repo-path . --llm-provider claude --api-key $CLAUDE_API_KEY

Exclude Patterns

securereview \
  --repo-path . \
  --llm-provider openai \
  --api-key $OPENAI_API_KEY \
  --exclude "*.test.js" "__pycache__" "node_modules"

With Different LLM Providers

# Google Gemini
securereview \
  --repo-path . \
  --llm-provider gemini \
  --api-key $GEMINI_API_KEY \
  --llm-model gemini-pro

# Anthropic Claude
securereview \
  --repo-path . \
  --llm-provider claude \
  --api-key $CLAUDE_API_KEY \
  --llm-model claude-3-opus

CI/CD Integration

SecureCodeReview integrates seamlessly with all major CI/CD platforms. Choose your platform below:

GitHub Actions

Basic workflow:

- name: Run SecureCodeReview
  run: |
    pip install securereview
    securereview \
      --repo-path . \
      --llm-provider openai \
      --api-key ${{ secrets.OPENAI_API_KEY }} \
      --output markdown

See examples/github-actions.yml for basic integration and examples/github-actions-advanced.yml for multi-LLM comparison.

GitLab CI

code_review:
  image: python:3.11
  script:
    - pip install securereview
    - securereview --repo-path . --llm-provider openai --api-key $OPENAI_API_KEY
  artifacts:
    paths:
      - review_report.md

See examples/gitlab-ci.yml for complete configuration.

Azure Pipelines

- task: UsePythonVersion@0
  inputs:
    versionSpec: '3.11'

- script: |
    pip install securereview
    securereview --repo-path $(Build.SourcesDirectory) --llm-provider openai --api-key $(OPENAI_API_KEY)

See examples/azure-pipelines.yml for complete configuration.

Jenkins

stage('Code Review') {
    steps {
        sh '''
            pip install securereview
            securereview --repo-path ${WORKSPACE} --llm-provider openai --api-key ${OPENAI_API_KEY}
        '''
    }
}

See examples/jenkins.groovy for declarative pipeline example.

CircleCI

jobs:
  code-review:
    docker:
      - image: cimg/python:3.11
    steps:
      - checkout
      - run: pip install securereview
      - run: securereview --repo-path . --llm-provider openai --api-key $OPENAI_API_KEY
      - store_artifacts:
          path: review_report.json

See examples/circleci.yml for complete configuration.

Bitbucket Pipelines

image: python:3.11

pipelines:
  default:
    - step:
        name: Code Review
        script:
          - pip install securereview
          - securereview --repo-path . --llm-provider openai --api-key $OPENAI_API_KEY

See examples/bitbucket-pipelines.yml for complete configuration.

Drone CI

kind: pipeline
type: docker
name: code-review

steps:
  - name: code-review
    image: python:3.11
    commands:
      - pip install securereview
      - securereview --repo-path . --llm-provider openai --api-key $${OPENAI_API_KEY}

See examples/drone-ci.yml for complete configuration.

CLI Arguments

usage: securereview [-h] --repo-path REPO_PATH [--local]
                    [--llm-provider {ollama,openai,gemini,claude}]
                    [--api-key API_KEY] [--llm-model LLM_MODEL]
                    [--output {json,text,markdown,html}] [--exclude EXCLUDE ...]
                    [--diff-file DIFF_FILE] [--git-diff GIT_DIFF]
                    [--severity {critical,high,medium,low,info}]
                    [--require-approval] [--no-mask-secrets]

Positional Arguments:
  (none - use --repo-path)

Required Arguments:
  --repo-path REPO_PATH     Path to repository to review

LLM Configuration:
  --local                   Use local Ollama (no API key needed)
  --llm-provider            LLM provider: ollama, openai, gemini, claude (default: ollama)
  --api-key API_KEY         API key for LLM provider (not needed for Ollama)
  --llm-model LLM_MODEL     Model name (e.g., gpt-4, gemini-pro, mistral)

Output Options:
  --output FORMAT           Output format: json, text, markdown, html (default: json)
                           html is interactive & downloadable
  --exclude PATTERNS        Patterns to exclude from review

Diff-Based Review (Cost Optimization):
  --diff-file PATH         Review from git diff file (not full repo)
  --git-diff BRANCH        Auto-extract diff from git (e.g., main, develop)
                          Reduces token usage by 90%+

Filtering & Approval:
  --severity LEVEL         Minimum severity: critical, high, medium, low, info
  --require-approval       Enable approval gate - blocks merges with critical issues
  --no-mask-secrets        DO NOT mask secrets (not recommended!)

Help:
  -h, --help               Show this help message and exit

Environment Variables

Set these environment variables instead of passing them as arguments:

export OPENAI_API_KEY="your-openai-api-key"
export GEMINI_API_KEY="your-gemini-api-key"
export CLAUDE_API_KEY="your-claude-api-key"
export LLM_PROVIDER="openai"
export LLM_MODEL="gpt-4"

Output Formats

JSON Output

Machine-readable format for programmatic processing:

{
  "status": "completed",
  "total_files": 10,
  "files_reviewed": 10,
  "critical_issues": 2,
  "warnings": 5,
  "findings": [
    {
      "file": "app/main.py",
      "language": "python",
      "severity": "critical",
      "analysis": "...",
      "suggestions": ["..."]
    }
  ]
}

Markdown Output

Human-readable report format for documentation:

# SecureCodeReview Report

**Status:** completed
**Files Reviewed:** 10
**Critical Issues:** 2
**Warnings:** 5

## Findings

### 🔴 app/main.py
**Severity:** critical
**Language:** python

[Analysis details...]

**Suggestions:**
- Suggestion 1
- Suggestion 2

Text Output

Plain text format for terminal display:

============================================================
SecureCodeReview Results
============================================================
Status: completed
Files Reviewed: 10
Critical Issues: 2
Warnings: 5
============================================================

🔴 app/main.py
   Severity: critical
   Suggestions: 2 found

Approval Workflow (Man-in-the-Loop)

SecureCodeReview enforces human approval for critical issues:

Code Review → 🔴 RED (Critical) → ⚠️ REQUIRES APPROVAL
            → 🟡 YELLOW (Suggestions) → ✅ CAN MERGE

RED (🔴) - Must Fix:

• Security vulnerabilities
• Performance problems
• Runtime errors
• Data integrity issues
• Exit code: 2 (approval required)

YELLOW (🟡) - Nice to Have:

• Code quality improvements
• Style suggestions
• Documentation
• Exit code: 0 (can merge)

See docs/APPROVAL_WORKFLOW.md for full details.

Security Features

Secret Detection & Masking

Automatically detects before sending to LLM:

• ✅ API Keys (Stripe, AWS, OpenAI, etc.)
• ✅ Database URLs (PostgreSQL, MySQL, MongoDB)
• ✅ Bearer Tokens & JWT
• ✅ Private Keys (RSA, DSA, EC)
• ✅ GitHub & Slack Tokens
• ✅ PII (SSN, Phone, Email)

Secrets are masked (first 3 + last 3 chars visible) before LLM:

Original:  api_key = "sk_live_<REDACTED_EXAMPLE_KEY>"
Masked:    api_key = "sk_live_**********************XX"

Read-Only Access

SecureCodeReview never:

• Modifies files
• Commits code
• Pushes to repository
• Merges pull requests
• Auto-deploys code

See SECURITY.md for vulnerability reporting.

Best Practices & Research

Diff-Based Analysis (Phase 3)

Review only changed code instead of full repository:

• Cost Savings: 90-99% token reduction
• Speed: Faster analysis, instant feedback
• Focus: Developers review context they changed

See docs/BEST_PRACTICES_AI_REVIEW.md for research-backed strategies.

Architecture

See docs/ARCHITECTURE.md for detailed architecture documentation.

Testing

# Run tests
pytest

# Run with coverage
pytest --cov=app --cov-report=html

# Run security checks
bandit -r app/
safety check

Contributing

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

Supported Languages

• Python (.py)
• JavaScript (.js)
• TypeScript (.ts)
• Java (.java)
• C++ (.cpp)
• C (.c)
• Go (.go)
• Rust (.rs)

Roadmap

Phase 3 ✅ Complete

• Diff-based code review (99%+ cost optimization)
• Multi-format output (JSON, Text, Markdown, HTML)
• Man-in-the-loop approval workflow
• Secret detection & masking
• Severity-based filtering
• Git integration

Phase 4 (Upcoming)

• PyPI package distribution
• GitHub Actions integration
• Tree-Sitter integration for advanced AST parsing
• Custom rule creation framework
• Web UI for report visualization
• Caching layer for repeated analyses
• Custom LLM endpoint support

License

This project is licensed under the MIT License - see the LICENSE file for details.

Support

• 📖 Documentation
• 🐛 Report Issues
• 💬 Discussions

Acknowledgments

Built with support from:

• OpenAI (GPT-4)
• Google Gemini
• Anthropic Claude
• FastAPI
• Pydantic

Author

Shubham Nagrare — Bangalore, India
7+ years in Logistics & FinTech

• Email: shubmnagrare@gmail.com
• GitHub: @ShubhamNagrare
• Project: SecureCodeReview

---

Phase 3 Status: ✅ Complete (Diff-based Review, Approval Workflow, Secret Masking)