POCanator
POCanator connects public GitHub Security Advisories with the commits that fix them. It brings advisory discovery, patch review, and AI-assisted educational analysis into one Django web application, with a standalone CLI for command-line workflows.
Advisory → patch → understanding
Search for advisories, extract their fixing commits, and inspect the changes in a syntax-highlighted diff viewer. Line numbers, addition and deletion markers, and collapsible files keep the patch readable.
Analysis you can inspect
Structured analysis covers vulnerability type, severity, CWE, patch effectiveness, educational PoC feasibility, and model-reported confidence. Token counts and estimated cost are shown per run. Cached results can be reused, or regenerated when a fresh analysis is needed.
Educational PoC generation pairs vulnerable patterns with secure fixes and framework-specific guidance. Generated analysis and code still need independent review; model confidence is not a security verdict.
Web app or command line
The web interface includes advisory browsing, patch review, analysis, and per-user provider settings. The standalone CLI can create HTML advisory reports and Markdown analyses. Setup and workflow details are in the repository.
Bring your own API key
Web analysis supports OpenAI and Anthropic Claude. Running the application yourself does not make the LLM analysis offline: analysis requests go to the selected provider, using your configured API key, and provider usage charges may apply.
Apache 2.0 licensed. Intended for authorized security research, defensive work, and education. Treat generated code as untrusted and review it before use in an isolated environment you control. This portfolio is a static showcase, not a hosted analysis service; it never collects API keys or runs PoCs.
