GitView CodeAudit: Go security reviews that never leave your laptop
This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle What I Built GitView CodeAudit is a security review for Go backends that runs on your laptop. A static analyzer finds the problems and collects the evidence; an open-weight model, Gemma running on Ollama, explains a finding when you ask, but it never decides one. GitView started as my terminal tool for…
GitView CodeAudit is a security review tool for Go backends that operates on your laptop. Developed from a terminal tool for monitoring Git changes and analyzing Go code, this tool includes a call graph, data flow, SQL operations, and HTTP routes with evidence. The project aimed to provide a solution for freelancers and small agencies who build Go APIs for clients.
Clients often require a security review before a launch, funding round, or due diligence, but such reviews usually come under an NDA, prohibiting the use of cloud AI tools. GitView CodeAudit allows one developer to perform the review on their own laptop and produce a real deliverable: an offline HTML report with each finding, the path leading to it, the evidence, and the reviewer's decision with justification.
The tool costs nothing per token, as each finding answers the client's questions about the location, why it occurred, how it was reached, the severity and confidence level, and how to fix it. The source code for GitView CodeAudit can be cloned from its GitHub repository, along with a small vulnerable API with safe variants of each case for testing.
The application can be installed using Go 1.25 and then launched with the `gitview audit scan` command. The report generated is a single offline HTML file with no network access, strict Content Security Policy, and redacted excerpts of the code.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.