AI security guardrail · 2026

ReachGate

Checks whether a scanner finding is actually reachable from your application's entry points. Industry data puts roughly four out of five critical findings down as noise; ReachGate turns that question into deterministic verdicts that export as OpenVEX and SARIF, re-checkable offline with no token and no network.

Solo · GitLab Transcend Hackathon

snapshot

type: AI security guardrail
period: 2026
source: public github
write-up: Most of your critical vulnerabilities cannot be reached
demo: watch

view repository →

problem

Security scanners can mark many findings as critical without proving that the vulnerable code is reachable. ReachGate turns that question into an auditable graph search with deterministic verdicts.

outcomes

Proved one live GitLab docs-site critical reachable and one not reachable, with signed receipts
Turned noisy scanner criticals into deterministic, re-checkable verdicts
Kept verdicts auditable through signed artifacts and offline verification

what i built

Bounded BFS over GitLab Orbit code graph data
Reachability verdicts for vulnerable code paths
Deterministic rule engine where AI only explains the result
UNKNOWN verdict when a search exceeds its budget
OpenVEX and SARIF exports for security tooling
sha256 manifest generation
Optional Ed25519 signature support
Offline verifier that needs no token and no network
CLI workflow for local checks
GitLab CI merge request bot with duplicate-comment prevention
GitLab Duo AI agent integration over the Orbit MCP server
A build-breaking test that rejects any fabricated 'safe' verdict

tech stack

PythonGitLab Orbit graph APIBFSGitLab CI/CDOpenVEXSARIFEd25519MCPpytest

Read the source

The repo has the code, structure, and implementation detail.

open repository →read the write-up