AI Code Security Platform

Pris.AI, MII's AI code security platform: eight scanners per pull request, readable AI triage and a fix agent that opens PRs with validation and guardrails.

8 engines
Scanning engines per pull request in a 100+ repository organization
628 PRs
Pull requests reviewed using scan results in 24 repositories
31 fix PRs
Fix-agent PRs opened in 7 repositories; 8 merged after human review

Role: Creator, sole engineer and operator, responsible for design, AI coding agent direction, review and release
Period: Jun 2026 to Oct 2026
Project type: Key project
Room in the 3D HQ: L3:ai-code-security-platform

Situation

A GitHub organization with 100+ repositories needed consistent pull-request security scanning, clear triage, and fixes that engineers could review safely before merging. Pris.AI became MII's AI code security platform for this, with me as its sole engineer and operator. Every fix had to stay reviewable, and scans of untrusted code had to stay away from production secrets.

Role and key decisions

Unified eight open-source scanners behind one GitHub App
Why: Engineers needed one consistent result per pull request, so I normalized every engine's output, added exploit-likelihood and known-exploited data, and kept finding identities stable across scans.
Kept every fix PR narrow and behind human review
Why: A fix that engineers cannot review is a new risk, so the agent patches only selected code regions within a token budget, never downgrades a dependency, and must pass protected-path guards and a rescan before it opens a PR.
Isolated scans from production secrets after an internal audit
Why: The audit reproduced untrusted repository code running alongside production secrets, so I led a 14-item hardening program that moved scans to isolated, autoscaled jobs with tokens scoped per job; the cut-over cost about 9 minutes of outage.

Results

8 engines
Scanning engines per pull request in a 100+ repository organization
Run in production through a GitHub App: Semgrep, Bandit, Trivy, OSV-Scanner, Grype, Gitleaks, TruffleHog and Checkov.
628 PRs
Pull requests reviewed using scan results in 24 repositories
Recorded by 24 Oct 2026; about 4.9k scans and 645k findings were processed by late September 2026.
31 fix PRs
Fix-agent PRs opened in 7 repositories; 8 merged after human review
Human review is required for every fix PR. This does not claim a higher merge rate.
~9 min
Production outage during cut-over to isolated scan jobs, closing the reproduced code-execution path
Completed within the 14-item isolation hardening using Contributor-level cloud rights.

Lesson

Threat-model the first deploy: running scans inline was a reasonable trade for permissions, but it needed a written threat model then, not an audit later. A flag reduces the risk within hours; isolation is what makes the remaining risk smaller.