Show HN: CommitGate – Automatically scan your commit for vulnerabilities

Show HN: CommitGate – Automatically scan your commit for vulnerabilities(github.com)

5 points by ductrl 11 days ago | 7 comments

Hello HN! I built a pre-commit code scanner that checks your staged changes for security vulnerabilities every time you run 'git commit'.

I am an inexperienced programmer and this is my first personal project. Any feedback, positive or negative, big or small, relevant or not, would be greatly helpful and appreciated!

The tool requires Gitleaks and Python to run, you will also need to use your own AI API key, which I understand is a big setup friction. You can check out my demo video instead if that is more convenient: https://youtu.be/ZYe5vWFRTus?si=9Fv8DhTHktwDK4mV

Thank you so much for giving my project a try!!!

asadeddin 11 days ago |

Full disclosure, Ahmad, CEO at Corgea.

Interesting approach, catching vulns at commit time before CI runs saves cycles. The challenge is always false positive rate at that stage and the AI inference time. How fast is the review? I saw the demo video and it seems you cut to the results.

ductrl 10 days ago | |

Hi Ahmad! Thank you so much for having a look at the project.

You're right that review time is quite challenging. The DeepSeek model we used needed at least 8-10 seconds to run a full review, which adds too much friction to the development process.

Right now, our approach to this is to give users a configurable timeout option. Within this timeframe, the model will stream the output as it generates, and the tool will print as many findings as it can.

Another option that we're exploring is to have the tool pre-push instead of pre-commit, which might reduce API cost and is way more tolerable than pre-commit.

You also brought up a very interesting point about false positive rate, as we haven't done large-scale testing yet. I will create an issue for this and get the result asap.

Bnjoroge 10 days ago |

Personally, I disable pre-commit hooks because they’re annoying and slow me down. Pre-push hook would make more sense. Secondly, i’d ideally want to use my codex/ claude subs for this, not an api key

ductrl 10 days ago | |

I agree, pre-commit is way too annoying. We're working to add a pre-push option and make it the default.

You made a great point about the codex/claude subs. I'll create an issue for this and we'll try to implement it. One challenge that comes to mind is that the output will be more unstable compared to the API so it might be more challenging to parse the findings.

Very interesting ideas. Thanks for trying out the tool!

buffer_overlord 11 days ago |

Vu1nz does something similar but at the PR level

ductrl 11 days ago | |

I am aware of existing tools doing the same thing at the PR level. I wanted to create a tool for commits since it is when the changes enter Git history.

I am also wondering if it makes more sense to have the tool check right before a push instead since that's when the vulnerabilities actually get sent to the Internet

buffer_overlord 11 days ago | | |

The problem for me was contributions I was getting 183 a day and couldn’t figure out what was malware and what was legit so my friend built me vu1nz