On-Device Security and Automated Code Remediation

Audit your code. Fix it. Prove it.

Airgapped code security auditing and AST-verified branch remediation running natively on Apple Silicon Metal GPU. 0 bytes of source code ever leave your Mac.

Apple Silicon (arm64) · Intel Mac (x64) · macOS 12+

Internet
GitHub
GitLab
Bitbucket
Azure
Private repos via token. Shallow clone.
Cloning
Your machine0 bytes out
secretsPII in logscryptoretentionaccesstransfers
src/api/users.js
142 logger.info(user.aadhaar)
Connect repoGitHub · GitLab · Bitbucket · Azure

Network is used once to shallow clone (read-only). Then the wire is cut.

The Architecture and Workflow

How Nadhi Audit Works

A story-driven walk through the modern code compliance lifecycle.

STEP 01The Problem

Cloud AI keeps reading your plaintext secrets.

You rotate your API keys today. The AI assistant accesses them tomorrow in your IDE, transmits code to third-party cloud servers, and the endless rotation loop continues.

1. IDE Reads Code2. Key Leaked to Cloud3. Force Rotation4. Leaks Again 🔄
🚨 Real-World Risk
// src/services/auth.js
const STRIPE_KEY = 'sk_live_51M00pX2eZvKYlo2...';
const DB_PASSWORD = 'ProductionSecretPassword!';
const JWT_SECRET = 'jwt_private_signing_key';
STEP 02Metal GPU Power

0 bytes of source code ever leave your Mac.

Inference runs completely on Apple Silicon Metal GPU. When cloud AI services are down, your security engine never stops. Zero telemetry, zero external network calls.

⚡ 20ms / file throughput
Inference ModeApple Silicon Metal GPU
Network Egress0 Bytes (Strict Offline)
Cloud Outage RiskZERO (Immune)
STEP 0340,000+ Dataset

Trained on 40k+ security trajectories and tool-calling.

Nadhi_Audit_FT.gguf is custom-trained to understand Abstract Syntax Trees, map exact CWE vulnerabilities, and apply non-destructive code patches.

✓AST-aware compiler verification (node --check, py_compile, php -l)
✓Deterministic pre-scan false positive filtering
✓LLM-as-a-Judge semantic diff verification before commit
🧠 Nadhi_Audit_FT.gguf
STEP 04One Pass Audit

One scan covers 4 global regulatory frameworks.

Audit codebases against the OWASP Top 10:2025 alongside regulatory mandates for healthcare and fintech.

🛡️ 4 Active Regimes
🛡️ OWASP Top 10:2025 / CWE
Vibe Audit — the January 2026 list, tuned for AI-generated code
🇮🇳 India DPDP Act 2023
Section 8(5) Safeguards and Log Retention
🏥 US HIPAA Compliance
Section 164.312 Transmission and Access Controls
🇪🇺 European Union GDPR
Article 32 Security of Processing
STEP 05Built for AI-Generated Code

The bug in generated code is usually a control that is missing.

A scanner finds bad lines. Generated apps fail on absent ones — a row-level security policy nobody wrote, a package that never existed, a key that is public because of its name. Nadhi runs four lanes over one tree and correlates them: findings that combine across lanes are reported as a single chain.

🔗 Cross-Lane Correlation
01Source patterns
Injection, XSS, weak crypto, secrets — plus the generated stack: service_role keys behind NEXT_PUBLIC_, client-side authorization, LLM keys in the browser
02Row-level security
Replays your migrations in order and reports which tables are served with no access policy at all
03Supply chain
Manifest against lockfile — catches dependencies that have never resolved, including hallucinated package names
04Deployed backend
Optional and read-only. Your migrations say what was intended; this checks what your live project actually enforces
STEP 06Not Just a Scanner

It writes the patch and verifies it on a branch.

Every patch is re-parsed by the compiler, re-scanned by the rule engine, and checked for the half-applied fix a parser cannot see — a value prepared and never passed, or a replaced line left dead below its replacement. A patch that fails is rolled back, not reported as done. Clean fixes land on nadhi/security-fixes.

✓ AST Syntax Passed✓ Rule Re-Scan Passed✓ No Dangling Binding✓ LLM Judge: ACCEPTED
🌿 Isolated Branch
@@ -15,7 +15,7 @@ export async function connectSFTP() {
- password: 'SuperSecretPassword2026', // ❌ HARDCODED SECRET
+ password: process.env.SFTP_PASSWORD, // ✓ SECURE ENV LOADER
});
STEP 07Zero Friction

Type /audit or /push-pr in Claude Code, Cursor, and Replit.

Connect in seconds via Model Context Protocol. Audit, apply verified multi-strategy repairs, and create GitHub Pull Requests with DCO sign-offs in 1 command.

🤖 Native MCP Server
$ claude mcp add --transport http nadhi-audit http://127.0.0.1:8765/mcp
✓ Connected to Nadhi Audit Daemon on Metal GPU
> /audit
4 findings detected · 4 AST-verified fixes generated on branch `nadhi`
> /push-pr
🚀 Pull Request Created: https://github.com/medplum/medplum/pull/10198
Proven In Production

Upstream Security PRs Merged by Maintainers

Nadhi Audit is actively discovering, validating, and landing fixes in critical healthcare infrastructure worldwide.

MERGED UPSTREAMAug 18, 2026

Medplum (Leading Healthcare FHIR Platform)

Autonomously audited and remediated TLS certificate verification (CWE-295) and credential handling (CWE-798). Merged into main by Medplum CTO.

View Pull Request #10198 on GitHub →
MERGED UPSTREAMAug 17, 2026

OpenELIS Global 2 (National Public Health LIMS)

Eliminated critical Protected Health Information (PHI) log leaks (CWE-532) protecting clinical lab deployments across 25+ countries and 250+ hospitals.

View Pull Request #4045 on GitHub →

Start Auditing on Metal GPU Today

Airgapped execution. Zero cloud data leaks. Compiler-verified fixes.

Apple Silicon (arm64) · Intel Mac (x64) · macOS 12+