Senior Application Security Engineer with experience of working in different industries, helping shape security protocol

Abdul Khan  • Peerlist

<p>This was part of the eco-system we created, where the organization did not have any format Security Review Board process for new feature or tools. With the increasing democratization of AI usage throughout the org, I found a huge gap in maintaining a security first approach while development. Now devs need to create a PR using a cookie cutter template where they add all details about the work they are proposing to do. We created a shared knowledge base using SOC2 audits, customer privacy policies, internal privacy policies and known secure coding and development best practices. The LLM reviews the plan based on this knowledge base and then similar to PR review bot, presents a summary and review comments. Once all comments are addressed, a human in the loop approves the PR. This project helped formalize an industry standard best practice and made it entirely streamlined</p>

SRB Bot

<p>Created an automated PR reviewer bot that runs as soon as a PR is created for a repo. The tool runs as a Github app that is given repo level access, once a PR is created Github actions runs the reviewer. Each line of code is sanitized for any security keys, PII or any other sensitive information before it is sent to an LLM. The LLM reviews the code on all security parameters, then creates a summary section of what the code is doing, categorizes issues into respective CVEs and writes review comments on the PR. This helps cut down time taken for QA. At the end, PR approval is done by a human in the loop. </p>