Trustable
Demo

Security Check

Security Check

Web application for automated source code security analysis. The user picks one AI model at a time from a catalog discovered at runtime from the configured provider, and gets back a structured vulnerability report.

React + TypeScript frontend, serverless backend on Apache OpenWhisk / Nuvolaris (v1/models + v1/analyze-model).

The app is provider-agnostic: no model list is hardcoded. Point it at any endpoint that speaks one of four protocols and it discovers what is there.

How it works

  1. On load the frontend calls GET /api/my/v1/models. The backend probes the configured AI_BASE_URL with read-only requests, detects the provider protocol, and returns the catalog of text/code-generation models plus a suggested default. The API key never reaches the browser — only the action sees it.
  2. The user selects a model from the dropdown.
  3. The user picks an input mode: file URL (Raw GitHub / Gist) or paste the code into a text area.
  4. On submit the frontend POSTs /api/my/v1/analyze-model with the selected model id. If a URL was given, the backend downloads and validates the content; pasted code is used directly.
  5. The backend routes one inference call to the detected protocol and returns a structured report: overall risk level, summary, and a list of findings with title, severity, category, line, description and recommendation.
  6. The UI streams the report in and reveals the findings one by one.

Only one model runs per analysis. To compare models, run the analysis again with a different one selected.

Supported protocols

The protocol is auto-detected — the hostname only chooses the probe order, the response shape decides. Unknown hosts are probed safely with read-only GETs.

ProtocolDiscoveryInferenceAuth
OpenAI-compatibleGET {base}/modelsPOST {base}/chat/completionsBearer
AnthropicGET {base}/modelsPOST {base}/messagesx-api-key
Google GeminiGET {base}/modelsPOST {base}/models/{model}:generateContent?key=
OllamaGET {base}/api/tagsPOST {base}/api/chatBearer (optional)

Model ids are used verbatim as the provider returns them; they are never rewritten.

Configuration

Two variables in .env:

# Base URL of the AI provider. Examples:
#  - local Ollama:      http://localhost:11434
#  - Ollama Cloud:      https://ollama.com          (requires AI_API_KEY)
#  - OpenAI-compatible: https://api.openai.com/v1   (requires AI_API_KEY)
AI_BASE_URL=

# Required by providers that authenticate requests.
# Leave empty for a local instance without authentication.
AI_API_KEY=

Then redeploy:

timeout 120 ops ide deploy

With a local Ollama, start it (ollama serve) and pull at least one model (ollama pull <model>) — the dropdown lists whatever ollama list reports.

If AI_BASE_URL is empty, both actions fail gracefully with “Provider AI non configurato. Imposta AI_BASE_URL nel file .env e ridistribuisci.” AI_API_KEY may stay empty: it is required by the provider, not by the actions. The key is never included in any response, log, error message, or reported endpoint.

Backend architecture

Retries and timeouts

The retry loop lives in the frontend: 1 attempt + 4 retries with 3-second pauses (5 total), each bounded client-side by a 3-minute AbortController that matches the backend’s 180s timeout. After 5 failures the model section shows a “riprova” button. The backend classifies transient failures (429, 500, 502, 503, 504, and “loading model” / “not yet ready” / “busy” responses) so a model that is still warming up is retried rather than reported as broken.

Input limits

Development