A reusable pipeline component that parses SAST and SCA reports, uses LLMs to judge each finding in context and filters out low-confidence alerts before code is merged.
I built this for my MBO graduation project at RiskStudio, working closely with a mentor in a live product environment. The goal was not to replace scanners such as Semgrep and OSV-Scanner, but to add a context-aware triage layer after them, while keeping delivery repeatable and auditable.
What I built
- A reusable GitLab CI/CD component for security triage, so multiple repositories get the same standardised, context-aware assessment
- A Python engine that parses SAST and SCA reports, applies RiskStudio-specific rules and decides whether the pipeline may continue
- LLM-based analysis that judges and prioritises each finding in its context
- A filter that drops low-confidence alerts, so developers see less scan noise
- Integration into CI/CD, so the gate applies to every code merge
What I learned
This project showed me how secure software delivery, CI/CD automation and AI risk management fit together, and why privacy matters: public cloud AI can be useful to get started, but production security scanning may need more controlled, local or private infrastructure.