A SAST + DAST analysis tool that provides thorough security scanning under one roof. LogSpec uses multiple rule-based scans with LLM context-based vulnerability flagging. It provides a complete report PDF along with AI remediations and an AI prompt to fix the report issues directly.
We have built a SAST + DAST analysis tool that provides thorough security scanning under one roof. LogSpec uses multiple rule-based scans with LLM context based vulnerability flagging. We provide a complete report pdf along with AI remediations and a AI prompt to fix the report issues directly.
Code is being pushed faster than ever. We cannot stay reliant on manual security auditing which could bottleneck the rapid development process. By the time the auditor finishes the security check manually, more code would have been pushed already. We directly integrate ourselves in the CI/CD pipeline by providing a simple quality gate to decide whether to push code to production or not. This saves hours of time and stress.
We run two types of scans.
This uses an open vulnerability database (OSV by Google) and an LLM agent (LangGraph).
- Dependency Scanners — OSV Scanner and Trivy scan
package-lock.json,requirements.txt, and other manifest files against known CVE databases. - Static Analysis Workers — Semgrep, Gitleaks, Checkov, Hadolint, and Conftest run rule-based pattern matching for code vulnerabilities, secret leaks, infrastructure misconfigurations, and policy violations.
- AI-Based Analysis Engine — An LLM agent (via Gemini / Bedrock) reviews source files for vulnerabilities that rule-based tools miss, producing context-aware findings.
We use a Docker Compose container with 3 images of ZAP, Wapiti, and WPScan. These tools thoroughly crawl all endpoints of a website and check for vulnerabilities.
Finally, we use rules to de-duplicate and LLM for AI Remediation and Summaries.
- Findings are fingerprinted and merged across scanners to eliminate duplicates.
- An LLM generates an executive summary with top issues, mitigations, and remediation effort estimates.
- A downloadable PDF report is generated with all findings, severity breakdown, and AI recommendations.
- React + Inertia Dashboard — The user interacts with the frontend built on React 19, Inertia.js v3, and TailwindCSS v4.
- Authentication & Authorization — Laravel Fortify handles user auth. JWT tokens are minted server-side for backend communication.
- Workflow & Job Dispatcher — Laravel controllers proxy requests to the Python backend and dispatch scan jobs.
- FastAPI Job Receiver — The Python backend (FastAPI + Granian ASGI) receives JWT-authenticated requests and enqueues scan tasks.
- Task Queue (Redis) — Celery workers pick up scan jobs from the Redis broker.
- Scanner Execution — Three categories run in parallel:
- AI-Based Analysis Engine — LLM-powered code review via Gemini or Bedrock.
- Dependency Scanner (OSV/Trivy) — Known CVE lookups against package manifests.
- Static Analysis Workers — Semgrep, Gitleaks, Checkov, Hadolint, Conftest for rule-based scanning.
- Analysis Output Processor — Results from all scanners are collected, fingerprinted, deduplicated, and merged into structured JSON.
- Data Layer — Findings are persisted to MySQL. Laravel DB stores users and config.
- Secure API Bridge — The frontend queries findings from the backend via authenticated API calls for data hydration.
- PDF Generation Service — A downloadable PDF report with severity breakdown, AI summary, top issues, mitigations, and all findings.
- PHP 8.4, Laravel 13, Fortify v1
- Inertia.js v3, React 19, TailwindCSS v4
- Barryvdh DomPDF for report generation
- Python, FastAPI, Granian ASGI server
- Celery + Redis for async task queue
- MySQL (asyncmy) for findings storage
- LangGraph for LLM agent orchestration
- Gemini / AWS Bedrock / OpenAI / Anthropic (BYOK) for LLM providers
- OSV Scanner — Google's open vulnerability database scanner
- Trivy — Container and filesystem vulnerability scanner
- Semgrep — Lightweight static analysis
- Gitleaks — Secret detection in git repositories
- Checkov — Infrastructure-as-code scanner
- Hadolint — Dockerfile linter
- Conftest — Policy-as-code testing (OPA/Rego)
- ZAP — OWASP Zed Attack Proxy (DAST)
- WPScan — WordPress vulnerability scanner (DAST)
- Wapiti — Web application vulnerability scanner (DAST)
- Pulsedive API integration for IOC (Indicator of Compromise) lookup — check reputation of IPs, domains, and URLs against threat feeds.
- Multi-scanner SAST pipeline with 8 scanners running in parallel
- DAST scanning with ZAP, WPScan, and Wapiti against live web targets
- LLM-powered code review and vulnerability detection
- AI-generated executive summary with top issues and mitigations
- Downloadable PDF report per scan
- Threat intelligence IOC lookup via Pulsedive
- Per-scanner finding counts and status breakdown
- Finding deduplication and fingerprinting across scanners
- BYOK (Bring Your Own Key) support for OpenAI, Anthropic, Gemini
- Quality gate for CI/CD pipeline integration