TODO.md

TODO: AI-Powered SAST Engine for Vulnerability Detection

Phase 1: Project Setup & Structure

• Create project directory structure
• Create SPEC.md with detailed architecture
• Set up Python virtual environment and dependencies (requirements.txt)

Phase 2: Data Collection & Preparation

• Create dataset collection module (vulnai/data/collector.py)
• Implement code preprocessing pipeline (vulnai/preprocessing/)
• Create tokenization and AST-based parsing
• Implement CodeBERT embedding generation

Phase 3: Model Training

• Design and implement model architecture (vulnai/models/classifier.py)
• Create training pipeline with PyTorch (vulnai/models/trainer.py)
• Implement multi-class classification for CWE categories
• Add evaluation metrics (Precision, Recall, F1, FPR)

Phase 4: Vulnerability Intelligence Storage

• Design database schema (vulnai/storage/database.py)
• Create vector storage for embeddings (vulnai/storage/vector_store.py)
• Implement vulnerability intelligence API

Phase 5: Detection Engine

• Build REST API with FastAPI (vulnai/api/)
• Create detection CLI tool (vulnai/cli/)
• Implement code parsing and vulnerability detection

Phase 6: Advanced Features

• Multi-language support (Python, Java, JS)
• Rule-based filtering for false positives (vulnai/detection/filter.py)
• Explainability features (vulnerable line highlighting)
• Incremental learning support (via feedback API)

Phase 7: Documentation & Deliverables

• Create README with architecture diagram
• Generate evaluation report with confusion matrix
• Package trained model (.pt/.onnx)
• Create training script (train.py)