AI BUILDERS HACKATHON 2026
CodeSentinel
Explainable Dependency-Risk Prioritization
From vulnerability findings to application-specific, evidence-backed decisions.
V
Vulnerability Intelligence
OSV-powered lookup across pinned Python dependencies.
R
Contextual Risk
A deterministic 0–100 score shaped by real application context.
E
Developer Explanation
AI translates the decision into clear, actionable guidance.
AI explains. The Risk Engine decides. Evidence supports the decision.
CodeSentinel · Explainable Dependency-Risk Prioritization
1 / 10
The Problem
Security findings pile up faster than developers can make sense of them.
!
Too Many Findings
Dependency scans can surface dozens of results per project, with no clear starting point.
≡
Generic Severity
A CVSS score alone doesn’t reflect how a vulnerability affects a specific application.
◈
Missing Application Context
Internet exposure, environment, and role change real risk — but scanners rarely capture it.
?
Difficult Prioritization
Without context, developers must guess which finding to investigate first.
“What should I investigate first?”
Developer time
Decision confidence
Small teams without dedicated AppSec
CodeSentinel · Explainable Dependency-Risk Prioritization
2 / 10
Our Solution
Every gap in the current workflow maps to a specific CodeSentinel capability.
Too many findings
Contextual priority ranking
Generic severity
Application-aware risk score
Opaque decision
Evidence + risk breakdown
Hard-to-read security output
AI explanation + remediation guidance
How it flows
Input
Vulnerability
Intelligence
Application
Context
Risk Engine
AI Explanation
Report
CodeSentinel · Explainable Dependency-Risk Prioritization
3 / 10
Innovation & Differentiation
The value isn’t another scanner — it’s a transparent decision layer on top of one.
D
Deterministic Risk Engine
A transparent, rules-based 0–100 score — no black box.
C
Contextual Priority
Environment, exposure, scope and role all shape the outcome.
B
Evidence-Backed Output
Every score ships with the exact risk drivers behind it.
A
AI as Explainer
AI narrates the decision — it never sets the score itself.
From raw signal to trusted decision
Vulnerability
Evidence
Context
Decision
Explanation
The differentiation is in the transparent decision layer.
Built on established vulnerability intelligence (OSV) — the innovation is in contextual scoring and explanation, not in inventing new vulnerability data.
CodeSentinel · Explainable Dependency-Risk Prioritization
4 / 10
System Architecture
Evidence and application context converge before the deterministic decision is made.
requirements.txt
Dependency Parser
OSV Vulnerability
Intelligence
Vulnerability Evidence
CVE / GHSA ID�Severity�Affected version�Fixed version�Summary
Application Context
Environment�Internet exposure�Dependency scope�Application role
Deterministic Contextual Risk Engine
Score
Priority
Evidence
Breakdown
AI Explanation Layer
Explanation
Recommendation
Security Dashboard
CodeSentinel · Explainable Dependency-Risk Prioritization
5 / 10
Workflow
From a plain requirements file to an explainable, evidence-backed report.
01
Upload
requirements.txt
02
Parse
Pinned Python dependencies
03
Lookup
OSV vulnerability intelligence
04
Context
Production / exposure / scope / role
05
Score
Deterministic 0–100 risk
06
Explain
AI + deterministic fallback
07
Report
Dashboard + evidence + recommendation
↓ continues
From raw requirements.txt to an explainable, evidence-backed priority — in one pass.
CodeSentinel · Explainable Dependency-Risk Prioritization
6 / 10
Risk Intelligence
A transparent, deterministic formula — applied the same way to every finding.
Severity
+
Production
+
Internet
Exposure
+
Runtime
Scope
+
Application
Role
=
Contextual Risk Score
Severity from OSV, context from the application — combined into one transparent score.
DEMO A
Environment
Production
Internet-facing
No
Dependency scope
Runtime
Application role
Other
50
MEDIUM · 50/100
DEMO B
Environment
Production
Internet-facing
Yes
Dependency scope
Runtime
Application role
Authentication
70
MEDIUM · 70/100
VS
Same vulnerability. Different application context. Different priority score.
CodeSentinel · Explainable Dependency-Risk Prioritization
7 / 10
Live Demo — From Finding to Decision
A real CodeSentinel scan turns vulnerability evidence and application context into an explainable priority.
PRODUCT SCREENSHOT
Insert a screenshot of a live CodeSentinel scan�
Show the finding, severity, risk score, priority, risk drivers, and explanation from an actual run.
.
What CodeSentinel decided
Finding
Evidence
Application Context
Deterministic Decision
Explanation
RISK SCORE
70/ 100
Medium
PRIORITY
Why? One accurate sentence on how application context shaped this outcome, from the real scan.
Evidence → Context → Score → Explanation
The numerical decision comes from the deterministic Risk Engine. AI explains the result.
CodeSentinel · Explainable Dependency-Risk Prioritization
8 / 10
Trust Model — AI Explains, CodeSentinel Decides
Security decisions stay deterministic. AI adds the explanation layer.
DETERMINISTIC DECISION ENGINE
01
EVIDENCE
OSV vulnerability
intelligence
Application context
02
RISK ENGINE
Deterministic formula
0–100 score
03
PRIORITY
Critical · High
Medium · Low
Minimal
A
AI Explanation Layer
Why it matters · what changed · what to investigate
CAN
✓ Explain the result
✓ Summarize why it matters
✓ Give developer-friendly guidance
CANNOT CHANGE
✕ Risk score
✕ Priority
✕ Risk drivers
✕ Vulnerability evidence
AI explains the decision. It does not become the decision.
CodeSentinel · Explainable Dependency-Risk Prioritization
9 / 10
Why CodeSentinel Matters
A practical decision layer for developers facing too many security findings.
DEVELOPERS
Know what deserves attention first
Turns raw vulnerability findings into understandable priorities.
SMALL TEAMS
Security decision support without dedicated AppSec
Reduces guesswork around dependency findings.
SECURITY
Evidence-backed, application-aware prioritization
Makes the reasoning visible instead of hiding it behind a black box.
● WORKING PROTOTYPE
Python
dependencies
OSV
intelligence
Application
context
Deterministic
risk
AI
explanation
Security
dashboard
FUTURE SCOPE
→
More ecosystems�
Python → additional package ecosystems
→
Richer context�
Deployment, service criticality, reachability
→
Developer workflows�
Team integrations and remediation workflows
“We found a vulnerability” is only the beginning.
CodeSentinel explains why it matters here — and what to investigate first.
CodeSentinel · Explainable Dependency-Risk Prioritization
10 / 10