CodeEvolver

Security flaws such as SQL injection are easy to write and easy to miss, especially for students and early-career developers. Static analysers flag patterns without explaining them, and general-purpose AI assistants can explain but require sending code to a third-party service and rarely ground their advice in an accepted standard.

CodeEvolver reviews a source file in three stages, using only small models that run on a single GPU. A GraphCodeBERT model, fine-tuned on labelled vulnerable and safe code, decides whether the file contains a given class of vulnerability. If it does, a retrieval-augmented generation step pulls the most relevant entries from a knowledge base of MITRE CWE records. Gemma 3 12B, quantised to 4-bit, then writes an HTML report: the line, the offending snippet, an explanation, and a suggested fix.

The team scraped 754 CWE and CVE vulnerability labels and grouped them into 10 families, from memory-bounds errors to injection and access-control flaws. The first classifier, trained on about 10,500 SQL-injection snippets, reached 0.999 F1 in five-fold cross-validation. Current work extends the classifiers to the remaining families, removes duplicate findings from reports, and benchmarks the pipeline against frontier language models.