llm-security-reviewer

AI-powered security code reviewer using a fine-tuned Qwen2.5-Coder-7B LLM. Scans code for vulnerabilities, reports CWE identifiers, and integrates directly with GitHub Pull Requests.

Requirements

• Python 3.10+
• NVIDIA GPU with CUDA (required — the model runs in 4-bit quantization)
• 8GB+ VRAM recommended

Installation

pip install llm-security-reviewer

Setup

Download the fine-tuned adapter weights and place them in a folder called adapters/:

your-project/
└── adapters/
    ├── adapter_config.json
    └── adapter_model.safetensors

For GitHub PR reviews, set your token as an environment variable:

# Windows
set GITHUB_TOKEN=your_token_here

# Linux / macOS
export GITHUB_TOKEN=your_token_here

Usage

Review a local file:

llm-reviewer --file path/to/main.c --adapters path/to/adapters

Review a code snippet directly:

llm-reviewer --code "void login() { gets(password); }" --adapters path/to/adapters

Review a GitHub Pull Request:

llm-reviewer --pr 42 --repo owner/repo --adapters path/to/adapters

Supported file types: .c, .cpp, .h, .py, .js, .ts, .java, .go, .php, .rb, .rs, .cs

Example Output

============================================================
  SECURITY REVIEW REPORT
============================================================
  Files/Functions reviewed : 4
  Vulnerabilities found    : 2
  Status: REVIEW NEEDED
============================================================

[1] main.c — function 1
    Verdict : VULNERABLE
    CWE     : CWE-120
    Review  :
      Buffer overflow via gets(). No bounds checking on input.
      Attacker can overwrite stack memory.

[2] main.c — function 2
    Verdict : SAFE
    CWE     : N/A
    Review  :
      Uses fgets() with explicit buffer size. No issues found.

RECOMMENDATION: Do not merge. Address the vulnerabilities above before merging.

Running Tests

pip install llm-security-reviewer[dev]
pytest tests/ -v

Troubleshooting

If the program only uses your CPU, make sure you have the right version of torch installed. Uninstall current version. Run nvidia-smi and check your CUDA version in the top right corner (CUDA Version: XX.X) Install torch for the right cuda version by replacing cuXXX with your CUDA version (exception: for CUDA 13.1+ you have to use 130)

pip uninstall torch torchvision torchaudio
nvidia-smi
pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cuXXX