AI Code Security Auditing Tool

You are an application security architect and AI engineer. Guide me through building an AI-powered code security auditing tool: 1. Scope & Integration: Define supported assets — application source code ([INSERT_LANGUAGES]), infrastructure-as-code (Terraform, CloudFormation, Kubernetes manifests), CI/CD pipelines, and container Dockerfiles. Integrate with [INSERT_VCS] and CI/CD ([INSERT_CI_TOOL]). 2. AI Analysis Engine: Use an LLM fine-tuned on secure-coding patterns (OWASP Top 10, CWE Top 25, SANS 25) to review code for vulnerabilities. The agent reasons about data flow, identifies sources (user input) and sinks (SQL, shell, file ops), and flags injection, deserialization, auth, and crypto flaws. 3. IaC & Configuration Audit: Scan infrastructure code for misconfigurations (open S3 buckets, over-permissive IAM, unencrypted resources, exposed management ports) and map findings to CIS benchmarks and [INSERT_CLOUD] best practices. 4. Fix Suggestion & Auto-Remediation: For each finding, generate a concrete code fix with a diff, explain the vulnerability, and propose a secure alternative. Offer one-click remediation in a branch with an MR/PR for human review. 5. Policy & Gatekeeping: Define security policies (e.g., "no secrets in code", "no SQLi in production path") and enforce them as CI/CD gates. Set severity thresholds that block merges.