Traceguard

TraceGuard is an automated DevSecOps gatekeeper built to secure AI-assisted software development pipelines (Cursor, Meta Muse Code, Copilot). Traditional RegEx and AST scanners cause high false alarm rates on clean code and fail against obfuscated or contextual leaks. TraceGuard inspects internal residual stream activations at Layer 16 of Meta Llama 3.1 8B (hosted via Modal serverless GPUs) to detect malicious intent, container escapes, and credential exfiltration in real time. Legitimate code yields nominal activation norms (~0.33), while active attacks (such as container pivot attacks and leaked temporary STS tokens) trigger massive vector spikes (~8.33, CVSS 9.8 Critical), throwing an exit code 1 to kill the CI/CD build before code merges. Every scan is committed to a tamper-evident SHA-256 cryptographic audit ledger.