On-Device Security & Automated Code Remediation

Audit your code. Fix it. Prove it.

Airgapped code security auditing and AST-verified branch remediation running natively on Apple Silicon Metal GPU. 0 bytes of source code ever leave your Mac.

Apple Silicon (arm64) · Intel Mac (x64) · macOS 12+

Internet
GitHub
GitLab
Bitbucket
Azure
Private repos via token. Shallow clone.
Cloning
Your machine0 bytes out
secretsPII in logscryptoretentionaccesstransfers
src/api/users.js
142 logger.info(user.aadhaar)
Connect repoGitHub · GitLab · Bitbucket · Azure

Network is used once to shallow clone (read-only). Then the wire is cut.

The Architecture & Workflow

How Nadhi Audit Works

A story-driven walk through the modern code compliance lifecycle.

01 · THE PROBLEM

The .env Secret Leak Loop

Cloud LLMs read plaintext API keys, JWT secrets, and database credentials straight from your IDE. You rotate keys today, the cloud assistant reads them tomorrow, and your proprietary credentials continue to leak over external networks.

1. IDE Reads Code2. Key Leaked to Cloud3. Force Rotation4. Leaks Again 🔄
src/services/auth.js
// src/services/auth.js
const STRIPE_KEY = 'sk_live_51M00pX2eZvKYlo2...';
const DB_PASSWORD = 'ProductionSecretPassword!';
const JWT_SECRET = 'jwt_private_signing_key';
⚡ Apple Silicon Metal GPU Engine0 Bytes Egress
Auditing: /workspace/medplum (7,442 files)
✓ Scan Complete · 100% Offline · No Cloud Dependencies
Scan Latency
20 ms / file
Cloud Downtime
Immune (0%)
02 · AIRGAPPED PRIVACY

100% Offline on Metal GPU

Zero bytes leave your Mac. When cloud AI services (Claude, ChatGPT, Gemini) suffer outages, your compliance and vulnerability audits never stop.

03 · MODEL ARCHITECTURE

Fine-Tuned on 40,000+ Security Samples

Powered by our custom in-house model (Nadhi_Audit_FT.gguf) trained on AST transformations, vulnerability patches, and strict compiler verification rules.

  • ✓Deterministic AST syntax gate (node --check, py_compile, php -l)
  • ✓LangGraph.js LLM-as-a-Judge pre-scan false positive filtering
🧠 Nadhi_Audit_FT.gguf
40,000+ Curated Vulnerability Trajectories & AST Rules
Compiler AST Syntax Gate: ZERO Unparseable Edits
LLM-as-a-Judge: 0% False Positive Maintainer PRs
🛡️ OWASP Top 10 / CWE
Global Code Security & Vulnerabilities
✓ SCANNED IN ONE PASS
🇮🇳 India DPDP Act 2023
Section 8(5) Safeguards & Log Retention
✓ SCANNED IN ONE PASS
🏥 US HIPAA Compliance
§164.312 Transmission & Access Controls
✓ SCANNED IN ONE PASS
🇪🇺 European Union GDPR
Article 32 Security of Processing
✓ SCANNED IN ONE PASS
04 · GLOBAL STANDARDS

4 Global Regulatory Regimes

A single scan simultaneously verifies your repository against global software security (OWASP Top 10 / CWE) and regional privacy mandates (India DPDP Act 2023, HIPAA, GDPR).

05 · CODE REMEDIATION

Not Just Audit — Verified Branch Fixes

Nadhi Audit doesn't just dump logs on you. It generates the exact code patch, validates that the vulnerability is removed without breaking syntax, and commits cleanly to an isolated branch.

Git Diff · branch: nadhi/security-fixes✓ VERIFIED
@@ -15,7 +15,7 @@ export async function connectSFTP() {
- password: 'SuperSecretPassword2026', // ❌ HARDCODED SECRET
+ password: process.env.SFTP_PASSWORD, // ✓ SECURE ENV LOADER
});
✓ AST Compiler Pass (node --check)
✓ Rule Re-Scan (Finding eliminated)
✓ LLM Judge Verdict: ACCEPTED
Terminal · Claude Code / Cursor MCP
$ claude mcp add --transport http nadhi-audit http://127.0.0.1:8765/mcp
✓ Connected to Nadhi Audit Daemon on Metal GPU
> /audit
4 findings detected · 4 AST-verified fixes generated on branch `nadhi`
> /push-pr
🚀 Pull Request Created: https://github.com/medplum/medplum/pull/10198
06 · ZERO FRICTION

1-Command MCP & Pull Request

Use your favourite coding agents. Type /audit in Claude Code or Cursor, review the animated diff card, and type /push-pr to open a DCO-signed GitHub Pull Request automatically.

Audit where the code lives.

Airgapped, on-device code security for every developer and team.

Apple Silicon · Intel Mac · Free for Community

... USD / year · Commercial & Enterprise

Multi-seat CI runners, team SLA, and executive compliance PDF reporting.