AI-Enhanced Static Code Analyzer for Secure Coding Support

Abstract

Many industrial security scanners including the popular Bandit tool discover security flaws; however, the information they give to the user is frequently technical and difficult to understand for those who are new to security. The goal of this project is to improve educational tools for secure programming that novice programmers can use by making static code checks easier to comprehend. A browser-based software tool called AegisCode was created using advanced mathematical techniques for counting and combinations. This tool makes use of Google's Gemini Large Language Model. While the current version utilizes a client-side simulation to provide immediate feedback, the proposed architecture details a Python Flask backend designed to run actual Bandit rule-based scanning to replace non-deterministic AI interpretations. The testing of the proof of concept showed it was performing well, and the whole analysis process was normally finished within five seconds. This process was also very accurate in producing well formatted JSON output which can be used by the user interface. This paper is innovative in its two-process theory, the conceptual underpinning for the translation of the technical diagnostics into the rich narrative stories for an education audience. Junior developers are provided with key security advice by the system so they can avoid security pitfalls. Learning how to programme using a tool such as this teaches developers good coding practices and appropriate methods of coding. It aids in promoting acceptable code practices. Future work will prioritize the transition to a deterministic backend and the integration of the Semgrep engine to expand language support beyond Python to include C++ and Java, ensuring compliance with OWASP and CWE standards.