llm-security-reviewer 0.1.1

AI-powered security code reviewer using a fine-tuned Qwen2.5-Coder LLM

llm-security-reviewer

AI-powered security code reviewer using a fine-tuned Qwen2.5-Coder-7B LLM. Scans code for vulnerabilities, reports CWE identifiers, and integrates directly with GitHub Pull Requests.

---

Requirements

• Python 3.10+
• NVIDIA GPU with CUDA (required — the model runs in 4-bit quantization)
• 8GB+ VRAM recommended

---

Installation

pip install llm-security-reviewer

---

Setup

Download the fine-tuned adapter weights and place them in a folder called adapters/:

your-project/
└── adapters/
    ├── adapter_config.json
    └── adapter_model.safetensors

For GitHub PR reviews, set your token as an environment variable:

# Windows
set GITHUB_TOKEN=your_token_here

# Linux / macOS
export GITHUB_TOKEN=your_token_here

---

Usage

Review a local file:

llm-reviewer --file path/to/main.c --adapters path/to/adapters

Review a code snippet directly:

llm-reviewer --code "void login() { gets(password); }" --adapters path/to/adapters

Review a GitHub Pull Request:

llm-reviewer --pr 42 --repo owner/repo --adapters path/to/adapters

Supported file types: .c, .cpp, .h, .py, .js, .ts, .java, .go, .php, .rb, .rs, .cs

---

Example Output

============================================================
  SECURITY REVIEW REPORT
============================================================
  Files/Functions reviewed : 4
  Vulnerabilities found    : 2
  Status: REVIEW NEEDED
============================================================

[1] main.c — function 1
    Verdict : VULNERABLE
    CWE     : CWE-120
    Review  :
      Buffer overflow via gets(). No bounds checking on input.
      Attacker can overwrite stack memory.

[2] main.c — function 2
    Verdict : SAFE
    CWE     : N/A
    Review  :
      Uses fgets() with explicit buffer size. No issues found.

RECOMMENDATION: Do not merge. Address the vulnerabilities above before merging.

---

Running Tests

pip install llm-security-reviewer[dev]
pytest tests/ -v

---

Project Structure

src/reviewer/
├── __init__.py       # package entry point
└── reviewer.py       # core logic — model loading, review, reporting
tests/
├── conftest.py       # shared stubs and fixtures
├── test_parsing.py   # patch parsing and function extraction
├── test_model.py     # verdict and CWE detection
├── test_github.py    # PR file filtering
├── test_reporting.py # report output
└── test_review_file.py

---

License

MIT