llm-security-reviewer

AI-powered security code reviewer using a fine-tuned Qwen2.5-Coder-7B LLM. Scans code for vulnerabilities, reports CWE identifiers, and integrates directly with GitHub Pull Requests.

---

Requirements

• Python 3.10+
• NVIDIA GPU with CUDA (required — the model runs in 4-bit quantization)
• 8GB+ VRAM recommended

---

Installation

pip install llm-security-reviewer

---

Usage

Review a local file:

llm-reviewer --file path/to/file.c

Review a code snippet directly:

llm-reviewer --code "void login() { gets(password); }"

Review a GitHub Pull Request:

llm-reviewer --pr 42 --repo owner/repo

Supported file types: .c, .cpp, .h, .py, .js, .ts, .java, .go, .php, .rb, .rs, .cs

Example Output

============================================================
  SECURITY REVIEW REPORT
============================================================
  Files/Functions reviewed : 4
  Vulnerabilities found    : 2
  Status: REVIEW NEEDED
============================================================

[1] main.c — function 1
    Verdict : VULNERABLE
    CWE     : CWE-120
    Review  :
      Buffer overflow via gets(). No bounds checking on input.
      Attacker can overwrite stack memory.

[2] main.c — function 2
    Verdict : SAFE
    CWE     : N/A
    Review  :
      Uses fgets() with explicit buffer size. No issues found.

RECOMMENDATION: Do not merge. Address the vulnerabilities above before merging.

---

Running Tests

pip install llm-security-reviewer[dev]
pytest tests/ -v

---

Troubleshooting

Model running on CPU instead of GPU

Your PyTorch installation may not have CUDA support. To fix this:

1. Uninstall the current version:

pip uninstall torch torchvision torchaudio

2. Check your CUDA version:

nvidia-smi

Look for CUDA Version: XX.X in the top right corner of the output.

3. Reinstall PyTorch with the matching CUDA version:

pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cuXXX

Replace cuXXX with your version — for example cu121 for CUDA 12.1, cu124 for CUDA 12.4.

Note: For CUDA 13.1 and above, use cu130 instead.