CodeGuard AI — Django Code Vulnerability Scanner with ML Severity Scoring | Final Year Project with Source Code

What This Project Actually Does

You paste a chunk of Python, JavaScript or PHP into a box. CodeGuard AI reads it — never runs it — and hands back a list of everything sketchy it found, ranked from Low to Critical, with an explanation of why each thing is a problem and how to fix it.

Under the hood there are three layers doing different jobs. Python files get parsed with the standard library's ast module, so the scanner is walking an actual syntax tree instead of guessing from string matches. JavaScript and PHP go through a regex rule engine instead, since writing a full JS parser for a college project is not a good use of your remaining semester. Every finding then goes to a RandomForest classifier trained on a synthetic labelled dataset, which decides how bad it really is. Finally the Groq LLaMA API (llama-3.3-70b-versatile) turns each finding into a human explanation and a suggested fix.

Results land on a dark terminal-style dashboard with a security score, a severity breakdown, and one expandable card per finding with syntax-highlighted code. There's a PDF export too, generated by WeasyPrint.

Key Features

• Scans Python, JavaScript and PHP — paste directly or upload a .py, .js or .php file up to 500KB.
• Python analysis runs on a real AST walk (scanner/analyzer.py), so it catches structural issues that plain keyword search misses.
• RandomForestClassifier assigns Low / Medium / High / Critical to every finding. The training script prints a classification report and feature importances — around 90% test accuracy, which is a great slide for your viva.
• Groq LLaMA writes the explanation and the fix suggestion for each issue. Responses are batched and cached in the database, so re-opening an old scan costs you zero API calls.
• One-click PDF report with the score, the breakdown and every finding — the thing your external examiner will actually want to hold.
• Optional accounts. Sign up and every scan gets saved to /history/ where you can re-download old reports. Skip signup and the scanner still works, the scan just isn't saved.
• "Try a sample" buttons load pre-written vulnerable snippets, so your demo works even if the wifi in the lab is being the usual disaster.
• The code is never executed. No eval, no exec, no shelling out to an interpreter. Findings come purely from syntax tree inspection and pattern matching — say this line out loud in your viva, examiners love it.

Real-World Applications

This is basically a miniature version of what tools like Bandit, Semgrep and SonarQube do in real engineering teams. A junior dev pushes code, a scanner runs in CI, and anything Critical blocks the merge.

Places this pattern actually shows up: pre-commit hooks in a startup's repo, security review during a code audit, teaching tools in a college security lab where students need to see why their SQL string concatenation is a bad idea, and internal dashboards at agencies who inherit client codebases and need a quick risk read before quoting a maintenance contract.

You can also pitch it as a learning tool. That framing tends to go down well in a project report — the explanation layer is the whole point.

Who Should Buy This

If you're a BCA or MCA student in your final semester, your submission date is uncomfortably close, and you want something that isn't the fourteenth library management system your guide has seen this month — this one. Cyber security topics get attention because most of your batch will submit CRUD apps.

It also suits BTech CSE students who need a project with a defensible ML component. The RandomForest isn't decoration here; it does actual classification work, and you can explain the feature set in two minutes.

Honest warning: there is one genuinely annoying part. PDF generation needs the GTK3 runtime on Windows, and pip won't install it for you — you run a winget command instead. Takes five minutes, but if you've never touched system-level dependencies it feels scary the first time. The installation guide below walks through it exactly. And the easy part that looks hard? The AST parsing. That's Python's own standard library, about twenty lines of visitor methods. No parser to write, no external grammar to configure.

Skip this if you want something purely frontend or you have zero interest in defending an ML pipeline in front of an examiner.

Why CodeAj

You get the complete source code — every Django app file, every migration, the training script, the templates, the .env.example. Along with it comes a college-format project report you can adapt to your university's template instead of writing forty pages from a blank document at 3 AM. If setup goes sideways on your machine, our project setup and installation support gets it running on a screen share. Students who want more hand-holding through the submission process can look at full mentorship till submission.

Browsing around before deciding? The cyber security projects collection has related builds, and if you specifically want more Django work, the Django projects with source code section is worth ten minutes of your time. Plenty of Python final year projects there that pair well with this one for a mini-project plus major-project combo.