# Soojal Labs

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Soojal Kalra](https://cerebralvalley.ai/u/soojalAi)
- **GitHub:** https://github.com/AiGod02/Agenitc-security-patch
- **Demo video:** https://youtu.be/wcJ7GleG5Oc
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/287

Verified Security Patch Agent is an AI agent that finds and fixes security vulnerabilities in Node.js/Express repositories, and proves every finding and every fix with real execution, not model guesswork.

The problem: AI coding agents often write security patches by guessing. They introduce regressions, hallucinate APIs, or “pass” tests by deleting the vulnerable route entirely. Developers can’t trust the output.

How it works: Paste any Express repo URL, and a 7-stage pipeline runs:

Static recon maps routes, middleware, auth checks and parameter sinks.
Candidate generation: Meta’s Muse Spark proposes vulnerability hypotheses across six OWASP classes (IDOR, SQL/command injection, path traversal, missing auth, hardcoded secrets, permissive CORS).
Sandboxed reproduction: each finding must be reproduced in a hardened Docker sandbox (no network, read-only root, dropped capabilities) with a test that fails deterministically twice. A companion test proves legitimate usage still works. Anything that doesn’t fail reliably is discarded as a false positive.
Planning and patching: Meta’s Muse Wonder plans a minimal fix with verified file-and-line evidence, and writes a held-out variant test the patch model never sees, so the fix can’t overfit to the original test.
Mechanical guards cap diffs at 40 lines, keep test directories byte-identical, and block removed routes.
Evidence advisory: a 9-section report where every cited line and snippet is checked against the real files.
Human approval: approval is bound to the SHA-256 hash of the exact diff, so changing even one character voids it. The fix is committed to an isolated review branch, and nothing is ever auto-merged.

Why it matters: Developers get security fixes they can verify rather than trust, with a clear audit trail and humans in control. It works on real repositories today.

Built solo with Python, FastAPI, LangGraph, Docker, and the Meta Model API (Muse Spark, Muse Wonder).

Links: Agent repo: github.com/AiGod02/Agenitc-security-patch Demo target: github.com/AiGod02/Node-Vulnerabilty

## More from Meta Global AI Developer Hackathon

- [Blackcord](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/284)
- [SurvAI](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/285)
- [CallReader](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/286)
- [AutoReply Pro](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/288)
- [Norba.io engineering](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/289)
- [Skuuy](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/290)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/287. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt