Automated Code Vulnerability Reviewing

This paper presented the proposed Automated Code Vulnerability Reviewing framework, which aims to assist developers in reviewing software repositories through a GitHub-integrated, role-based multi-agent architecture. The framework combines repository analysis, source-code context preparation, and specialized review agents to examine security vulnerabilities and software architecture-related concerns. The proposed system consists of three agents: the Security Auditor Agent, the Software Architect Agent, and the Review Moderator Agent. The first two agents perform their respective analyses in parallel, while the moderator consolidates their findings, removes duplicates, handles conflicting observations, and prioritizes the reported issues. The framework also proposes a local execution environment with a web-based dashboard and command-line interface, providing developers with access to structured review reports. Unlike systems that directly modify source code, the proposed framework focuses on identifying potential issues and providing recommendations for developer verification. Its planned integration with GitHub is intended to support both manual and event-triggered code reviews. The paper also discussed the proposed methodology, evaluation approach, limitations, and security considerations. Since the framework is currently at the proposal stage, its practical effectiveness, accuracy, and performance have not yet been experimentally established. Future implementation and testing will be required to validate its capabilities and determine its usefulness in real-world software development environments.

[1] J. Yu, P. Liang, Y. Fu, A. Tahir, M. Shahin, C. Wang, and Y. Cai, “An insight into security code review with LLMs: Capabilities, obstacles and influential factors,” arXiv preprint arXiv:2401.16310, 2024. [Online]. Available: https://arxiv.org/abs/2401.16310 [2] R. I. T. Jensen, V. Tawosi, and S. Alamir, “Software vulnerability and functionality assessment using LLMs,” arXiv preprint arXiv:2403.08429, 2024. [Online]. Available: https://arxiv.org/abs/2403.08429 [3] T. Sharanarthi and S. Polineni, “Multi-Agent LLM Collaboration for Adaptive Code Review, Debugging, and Security Analysis,” in Proc. 2025 International Conference on Mechatronics, Robotics, and Artificial Intelligence (MRAI), 2025, doi: 10.1109/MRAI65197.2025.11135756. [4] V. Belozerov, P. J. Barclay, and A. Sami, “Secure coding with AI—from detection to repair,” Empirical Software Engineering, vol. 31, art. no. 93, 2026, doi: 10.1007/s10664-026-10812-8. [5] Tree-sitter, “Introduction,” Tree-sitter Documentation. [Online]. Available: https://tree-sitter.github.io/tree-sitter/. [Accessed: Oct. 29, 2026]. [6] OWASP Foundation, “OWASP Top 10 for Large Language Model Applications,” OWASP GenAI Security Project, 2026. [Online]. Available: https://genai.owasp.org/llm-top-10/