STATEFUL
SECURITY
CO-PILOT.
Unlike stateless scanners that drop noisy comments, GitSentry remembers architectural decisions in Firestore, audits pull requests with dual-tier Gemini intelligence, and autonomously submits precision remediation PRs while gating merges.
SQL Injection in find_user_by_email()
- query = f"SELECT * WHERE email = '{email}'"+ query = "SELECT * WHERE email = %s"Webhook Ingestion Delay
Pub/Sub decoupled async queue
Architectural Memory Recall
Firestore stateful project history
Gemini 3.7 Flash Thinking
Low (Triage) & High (Deep Audit)
Unblocked High-Risk PRs
Automated commit status gating
CONSTRUCTIVIST
ARCHITECTURE.
A battle-tested serverless architecture on Google Cloud Platform engineered for resilience, strict zero-leak secret handling, and real-time GitHub integration.
Decoupled Webhook Ingestion
Cloud Run Receiver + HMAC-SHA256 + Pub/Sub
GitHub PR events arrive at the Webhook Receiver. Signatures are verified with constant-time HMAC comparison before instant publishing to the 'pr-events' Pub/Sub queue, eliminating webhook timeouts.
Two-Tier Gemini Reasoning
Gemini 3.7 Flash (Low & High Thinking) + ADK
Worker executes rapid triage (<200ms) with thinking_level=LOW. High-risk signals trigger deep threat audits with thinking_level=HIGH, cross-referencing Firestore Memory Bank and OSV.dev databases.
Autonomous Action Engine
Remediation PR & Commit Gating
Sets commit status 'gitsentry/security' to block unsafe merges. Generates precision patch diffs, creates a dedicated branch, and autonomously opens a ready-to-merge remediation PR.
AUTONOMOUS
SECURITY POWERS.
FORM FOLLOWS FUNCTION: Every security check produces actionable, auditable, and enforceable code fixes.
Stateful Decision Memory Bank
Remembers past architectural approvals, security exemptions, and RFCs across repos in Firestore so developers never re-litigate approved designs.
Developer Habit Profiler
Continuously detects recurring developer patterns (e.g. raw string SQL concatenation or wildcard CORS) and delivers targeted coaching in PR reviews.
OSV.dev CVE Automated Patching
Scans dependencies on every PR against Google's open-source OSV.dev vulnerability database and computes minimum safe version bumps.
Strict Commit Status Merge Gating
Sets 'gitsentry/security' GitHub commit status checks to failure on high risks, physically preventing merge until resolved or formally overridden.
Autonomous Remediation PRs
Generates clean unified git diffs, creates a dedicated remediation branch, and opens a companion pull request ready for one-click merge.
Human-in-the-Loop Override Flow
Developers can tag @gitsentry with approved business justifications in PR comments; GitSentry evaluates validity before clearing commit status.
LIVE AUDIT
THREAT STREAM.
Real PR security events processed live through Gemini 3.7 Flash two-tier reasoning, stateful memory recall, and OSV.dev lookup.
feat(staging): add unauthenticated health probe
feat(prod): expose health probe on production
feat(auth): lookup user by email with raw SQL query
Gemini 3.7 Flash Security Audit
Execution Latency: 740ms | Tier: HIGH
DEC-89: Staging env allows unauthenticated /health route for internal VPC synthetic uptime monitors
Approved by: sufiyantesting789 (SecOps Lead) in PR #1
--- a/src/routes/health.py
+++ b/src/routes/health.py
@@ -5,3 +5,4 @@
+# [GitSentry DEC-89]: Allowed unauthenticated for VPC synthetic probe only
@app.get("/health")
def staging_health():
return {"status": "healthy", "env": "staging"}FREQUENTLY ASKED
TECHNICAL QUESTIONS.
Everything you need to know about two-tier Gemini thinking, stateful Firestore memory persistence, and commit gating.
GitSentry automatically indexes approved security exemptions, compensating controls, and risk acceptances in a Google Cloud Firestore Memory Bank. When new PRs are submitted, GitSentry uses Gemini 3.7 Flash with high-thinking mode to perform stateful recall, checking whether the new code respects prior constraints or attempts to expand the exemption scope without authorization.