1 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

GENERATIVE AI & AGENTIC SYSTEMS

Think. Build. Secure. | Currently local-first

01 / 07

KYRO

Think. Build. Secure.

Autonomous software security

and engineering intelligence

Evidence-backed findings. Approved changes.

Independent verification.

RUNS LOCALLY THROUGH DOCKER

Night Raid

FOUR MEMBERS / B.TECH CSE / THIRD YEAR

Gaurav Wakle

TEAM LEAD

Rudransh Jaiswal

MEMBER

Savinay Pathak

MEMBER

Pranad Bhale

MEMBER

G. S. Mandal’s Marathwada Institute of Technology

Chhatrapati Sambhajinagar (Aurangabad)

Contact: github.com/Gauravwakle96

Team ID: Not issued

2 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

PROBLEM STATEMENT

A finding still needs an engineering investigation.

Developers need to turn scanner output into a relevant, tested, reviewable change.

Think. Build. Secure. | Currently local-first

02 / 07

01

Fragmented evidence

Source rules, dependency advisories and repository context must be reviewed together.

02

Uncertain relevance

Severity alone does not establish whether affected functionality is referenced or reachable.

03

Risky remediation

A patch can remove a finding and still break behavior. Builds, tests and rescans are essential.

WHO BENEFITS

Developers • AppSec teams • Open-source maintainers • Small engineering teams

Practical need: prioritize work, preserve application behavior, and leave evidence for review.

3 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

PROPOSED SOLUTION

One controlled workflow from finding to evidence.

Repository context + mature scanners + a bounded agent + an independent verifier.

Think. Build. Secure. | Currently local-first

03 / 07

01

Connect

Authorized GitHub

repository + branch

02

Understand

Index code, imports

and dependencies

03

Investigate

Scan, normalize

and explain risk

04

Approve

Review a model plan

and exact scope

05

Remediate

Docker patch,

build and tests

06

Verify

Rescan + report;

PR API integrated

Evidence-aware prioritization

Preserve scanner provenance; show references, confidence and analysis limits.

Human control

Approval binds file scope and hashes. Tool, time, retry and budget limits remain enforced.

Separate verification

Recorded builds, tests and rescans decide outcomes; missing evidence stays inconclusive.

MEASURED FIXTURE: 22 → 21 findings • build + 4 tests pass • 6 regression tests pass • 0 new findings

21 findings remain. Expected benefits will be evaluated by time-to-verified-fix and review effort; no comparative gain claimed.

The journey is connect, understand, investigate, approve, remediate and verify. A selected controlled arithmetic fixture completed actual local-model planning and Docker execution. Dynamic eval was replaced by restricted AST arithmetic. The build and four original tests passed, and six additional independent arithmetic/security regression tests passed on a disposable copy. Three scanners were rerun; the selected issue resolved, counts changed from 22 to 21 and no new findings were reported. Twenty-one dependency findings remain. This is one measured case, not a general success rate or competitor comparison. The draft PR engine is implemented and contract-tested but a live product-generated remediation PR remains unrun. Evidence date: 7 November 2026, docs/evidence/recovery-workflow/live-verification.json.

4 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

ARCHITECTURE & DATA FLOW

A local modular monolith with isolated execution.

Think. Build. Secure. | Currently local-first

04 / 07

React workspace

Authenticated UI • API requests • SSE

Persistent storage

SQLite / PostgreSQL

Evidence, jobs, audits

GitHub API

Authorized snapshot

Branch metadata

Draft PR API

FastAPI backend

Owner checks + CSRF

Secrets stay on backend

Plans, approval and reports

DB-backed worker

Persistent state + bounded retries

Sequential resource-heavy jobs

Docker workspaces

Semgrep • OSV • Trivy

Patch, build and test containers

Independent rescan

Context selection

File / symbol / dependency context

Repository content is untrusted

Local Qwen model

Ollama / llama.cpp

Structured output validation

AI PIPELINE

Relevant context → model plan → human approval

TEST/PATCH POLICY

No host scripts or credentials.

Non-root; network denied;

CPU / memory / process limits.

Local-only mode blocks external model calls. GitHub/advisory access is separate. Docker socket requires a trusted dedicated host.

5 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

TECHNOLOGY STACK

Small components. Real integrations. Local inference.

Think. Build. Secure. | Currently local-first

05 / 07

FRONTEND

React 19 + TypeScript + Vite

TanStack Query • React Router • Lucide • CSS design tokens

BACKEND & DATA

FastAPI + Pydantic + SQLAlchemy + Alembic

SQLite local default; PostgreSQL migration/constraint acceptance tested

CODE INTELLIGENCE

Python AST + JavaScript / TypeScript Tree-sitter

File hashes, symbols, imports, dependency references and selected context

SECURITY

Semgrep 1.184.0 • OSV-Scanner 2.7.0 • Trivy 0.76.2

Actual container adapters; OSV / NVD / EPSS / CISA KEV enrichment

AI & CONTROL

Local Qwen via Ollama / llama.cpp

qwen2.5-coder:7b tested; Qwen3 8B Q4 compatible; local-only enforcement

DELIVERY & QA

Docker Compose + GitHub API + GitHub Actions

Pytest • Vitest • Playwright • Ruff • mypy • dependency / secret checks

RESOURCE CHOICE

One worker, sequential scanners, one small local model. Optional cloud adapter has no successful live acceptance.

6 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

WORKING APPLICATION & DEMO

Currently runs locally through Docker.

Think. Build. Secure. | Currently local-first

06 / 07

NO PUBLIC APPLICATION DEPLOYMENT

Actual controlled-test workspace capture • selected remediation succeeded and verified

RECORDED CHECKS / 07 NOV 2026

132

backend tests

9

UI unit tests

14

browser tests

LIVE REPOSITORY AUDIT

19 authorized repos processed; 17 indexed.

8 complete scans; 9 inconclusive; 2 empty.

347 normalized findings preserved.

PUBLIC SOURCE + SETUP

github.com/Gauravwakle96/KYRO

Recorded test evidence ↗

Demo video: to be recorded (2–3 minutes).

Live product-generated remediation PR: unrun.

KYRO runs locally right now. The configured local Docker URL is http://127.0.0.1:8787; there is no public hosted application. The public GitHub source contains setup documentation and recorded evidence. This screenshot is an actual controlled fixture workspace; it is not a user's production repository or a fabricated success. Recorded checks dated 7 November 2026 include 132 backend, nine frontend unit and 14 deployed browser tests. A separate authorized repository audit processed 19 repositories; 17 indexed, eight scans completed and nine were inconclusive. Two repositories were empty at that audit time, including KYRO before source publication. There were 347 normalized findings. The product's live remediation PR acceptance is still unrun; publishing our own source is separate. A 2–3 minute demo video still needs to be recorded. Public app hosting is optional for this submission. The local workflow provides actual scanner, model, container and verification evidence, rather than a frontend-only demonstration.

7 of 7

K | KYRO

NIGHT RAID / NOVASTARK HACKS 2026

SCALABILITY & ROADMAP

Start on one laptop. Expand with measured evidence.

Think. Build. Secure. | Currently local-first

07 / 07

ROUND 2

Verify a real-repository fix and PR

Public URL import; approved fix and actual draft PR.

Broader scanner rules and regression fixtures.

FINALE

Broaden reliability and collaboration

Fork contribution flow; stronger reachability; team roles.

Concurrent dispatch and dedicated runner isolation.

SCALABILITY STRATEGY

Now: one worker, sequential scanners, incremental file indexing.

Next: measured queue limits, PostgreSQL deployment, retention and dedicated runners.

USERS & FEASIBILITY

Open-source local workflow for developers and maintainers.

Managed team hosting is a future option; no revenue or market validation claimed.

Thank you. Let’s review the evidence.

Q&A

The current product is a single-owner local application with one persistent worker. Incremental file indexing and sequential scanner execution keep it practical on the available laptop. Round 2 should complete an approved real-repository fix and actual draft PR, add public URL import and broaden rules and test fixtures. Fork-based contributions, stronger reachability, team permissions and concurrency need additional implementation and acceptance. PostgreSQL migrations are already tested; a full team/public deployment is not. Dedicated runners and stronger isolation are prerequisites for handling repositories from multiple untrusted users. Local open-source use is the initial feasibility path. Paid managed hosting is only a future possibility, with no commercial results or market validation claimed. Thank you to the jury and organizers; we welcome questions.