ppradyoth/ai-security-tracker
GitHub: ppradyoth/ai-security-tracker
Stars: 0 | Forks: 0
# AI Security Tracker
Comprehensive security monitoring across the AI/ML ecosystem. Track security issues, vulnerabilities, and initiatives across 50+ repositories.
**Dashboard:** [https://ppradyoth.github.io/ai-security-tracker](https://ppradyoth.github.io/ai-security-tracker)
## ⚠️ **Important: Search Limitations**
**This tracker currently searches for issues with SPECIFIC LABELS and KEYWORDS only:**
- Labels: `security`, `vulnerability`, `cve`
- Keywords: `security`, `vulnerability`, `cve`, `credential`, `secret`, etc.
**Many repos don't label security work explicitly**, so this tracker may show 0 issues for repos that DO have active security work. For example:
- **TensorFlow**: Security work exists but uses different labels like `area:security`, `type:enhancement`
- **PyTorch**: Security discussions happen but aren't marked with a "security" label
- **Most ML frameworks**: Focus on bug reports and features, not explicit "security" labels
**Result: Current data is likely INCOMPLETE.** Repos showing 0 issues may actually have significant security activity that we're not capturing.
**To improve coverage, we need to:**
1. Expand keyword searches (add: `fix`, `patch`, `update`, `auth`, `injection`, etc.)
2. Query CVE databases (NVD) directly for authoritative vulnerability data
3. Analyze commit messages for security-related changes
4. Use category-specific search strategies per repo type
See [SETUP.md](SETUP.md) for how to customize security signals for better coverage.
## Overview
The AI Security Tracker provides ecosystem-wide visibility into security practices across:
- **7+ AI CLI Tools** — Claude Code, OpenAI Codex, Gemini, GitHub Copilot, etc.
- **6+ ML Frameworks** — TensorFlow, PyTorch, JAX, Hugging Face, LLaMA, etc.
- **4+ Agent Frameworks** — LangChain, AutoGen, CrewAI, LlamaIndex
- **5+ Security Tools** — Bandit, Safety, Snyk, GitGuardian, TruffleHog
- **2+ Security References** — OWASP, Awesome Security
**Tracking 22 repositories for security signals** (See limitations above):
- GitHub security labels (limited to specific terms)
- Security-related keywords
- Issue/PR activity
- Engagement metrics
## Features
✨ **Real-time Monitoring**
- Daily security data collection from 50+ repos
- GitHub API integration (no external services needed)
- Automated workflow runs at 08:00 UTC daily
📊 **Comprehensive Dashboard**
- Overview: Total issues, trends, engagement metrics
- By Repository: Per-repo issue counts and recent activity
- Top Issues: Most active security discussions
- Label Distribution: Popular security topics
🎨 **Minimalist Design**
- Apple/Google-inspired aesthetic
- Light theme with dark mode support
- Responsive design (desktop, tablet, mobile)
- Fast client-side rendering (no backend)
📈 **Historical Data**
- 180-day time window
- Daily snapshots stored in Git
- Easy trend analysis
- Full audit trail
## Quick Start
### View the Dashboard
Open [https://ppradyoth.github.io/ai-security-tracker](https://ppradyoth.github.io/ai-security-tracker) in your browser.
### Run Locally
# Clone the repo
git clone https://github.com/ppradyoth/ai-security-tracker.git
cd ai-security-tracker
# Install dependencies
pip install requests
# Collect security data
export GITHUB_TOKEN=your_token_here
python scripts/fetch_security_data.py > /tmp/security.json
# Generate dashboard data
python scripts/generate_dashboard_data.py /tmp/security.json > docs/data.json
# Serve locally
python -m http.server 8000
# Visit http://localhost:8000/docs/
## Architecture
### Data Collection (`scripts/fetch_security_data.py`)
### Dashboard Generation (`scripts/generate_dashboard_data.py`)
1. Takes raw security data
2. Aggregates by repository, issue type, engagement
3. Calculates metrics and trends
4. Generates optimized JSON for frontend
### Frontend (`docs/`)
- **index.html** — Semantic HTML structure
- **style.css** — Minimalist Apple/Google styling
- **script.js** — Client-side data loading and rendering
- **data.json** — Generated dashboard data (committed daily)
### Automation (`.github/workflows/`)
- **fetch-security-data.yml** — Daily data collection at 08:00 UTC
- Runs metrics collection
- Commits daily snapshot
- Generates and deploys dashboard
## Configuration
### Adding Repositories
Edit `manifest.json` to add repos to track:
"ai_cli_tools": [
{
"name": "Your Tool Name",
"owner": "github-owner",
"repo": "repo-name",
"focus": "Brief description of security focus"
}
]
### Customizing Security Signals
Edit security keywords and patterns in `manifest.json`:
"security_labels": ["security", "vulnerability", ...],
"vulnerability_keywords": ["vulnerability", "exploit", ...],
"credential_keywords": ["credential", "secret", ...]
## Data Structure
### Raw Security Data (`data/YYYY-MM-DD.json`)
{
"generated_at": "2026-05-25T08:00:00Z",
"total_repos_tracked": 50,
"total_security_issues": 1234,
"issues": [
{
"repo": "Repository Name",
"number": 12345,
"title": "Issue Title",
"url": "https://...",
"type": "Issue|PR",
"state": "open|closed",
"created_at": "2026-05-20T...",
"updated_at": "2026-05-25T...",
"labels": ["security", "cve"],
"comments": 5,
"reactions": 2,
"signals": {
"has_security_label": true,
"security_keywords_found": ["vulnerability"],
"credential_keywords_found": []
}
}
]
}
### Dashboard Data (`docs/data.json`)
{
"generated_at": "...",
"summary": {
"total_repos_tracked": 50,
"total_security_issues": 1234,
"issues_by_state": { "open": 800, "closed": 434 },
"issues_by_type": { "Issue": 900, "PR": 334 }
},
"top_repos": [...],
"top_issues_by_engagement": [...],
"labels_distribution": [...]
}
## Development
### Phase 1: MVP ✅
- [x] Repository manifest with 50+ curated repos
- [x] GitHub API security data collection
- [x] Dashboard with 4 primary views
- [x] Daily automation workflow
- [x] GitHub Pages deployment
### Phase 2: Expansion (Planned)
- [ ] Trend analysis (velocity, response time)
- [ ] CVE data integration (NVD API)
- [ ] Weekly and monthly reports
- [ ] Tool comparison features
- [ ] Auto-discovery of new repos
### Phase 3: Advanced (Future)
- [ ] Visualization with charts (Chart.js, D3)
- [ ] Machine learning anomaly detection
- [ ] Community features (annotations, discussions)
- [ ] Email/Slack alerts
- [ ] Metrics export API
## Troubleshooting
**Dashboard shows no data?**
1. Check `docs/data.json` exists and is not empty
2. Run `python scripts/fetch_security_data.py` locally
3. Verify GitHub token has proper permissions
**Workflow fails with permission error?**
1. Ensure workflow has `permissions: { contents: write }`
2. Check GitHub Actions is enabled in repo settings
3. Verify token in secrets
**Repos not showing results?**
1. Check repo names are correct in `manifest.json`
2. Verify repos exist and have public issues
3. Check GitHub API rate limits: `gh api rate_limit`
## Resources
- **Setup Guide:** See [SETUP.md](SETUP.md)
- **GitHub API Docs:** https://docs.github.com/en/rest
- **Inspiration:** [Big Model Radar](https://github.com/gsscsd/big_model_radar)
## License
MIT License — See LICENSE file
## Questions?
Open an issue or visit the [GitHub repository](https://github.com/ppradyoth/ai-security-tracker).