Product Case Study · DevSecOps & Agentic AI
Cutting vulnerability remediation from 90 days to 3 — security that writes itself.
From a Kalpita hackathon build to Kalpita CodeGuard: a fully developed autonomous DevSecOps product that detects a flaw, writes the fix, and opens a human-approved pull request in under three minutes.
90%
MTTR improvement
91%
less PR review time
< 3 min
commit to reviewed pull request
~$2.4M
modeled annual saving
Overview
Six things CodeGuard changes about application security
Security that writes itself.
CodeGuard detects a flaw, analyzes root cause, and generates a human-approved pull request in under 3 minutes per commit.
91% less PR security review time.
from 45 minutes to 4 minutes — and a 90% MTTR improvement, from 60–90 days to 3–7 days.
~$500 saved per fixed vulnerability, modeled at ~$2.4M a year for a 500-developer organization.
~$500 saved per fixed vulnerability, modeled at ~$2.4M a year for a 500-developer organization.
AI proposes, humans approve.
Every fix arrives as a reviewable PR with a plain-English explanation — no code ships unreviewed.
Security as a teammate, not a gate.
A developer leaderboard awards +100 points for every merged fix, changing the culture around security.
A Kalpita hackathon-to-product story.
one more offering in Kalpita’s growing portfolio of AI products and solutions.
Summary
Legacy scanners flag the problem. CodeGuard writes the fix.
In most teams, security is a bottleneck. Manual review misses around 30% of flaws, a single PR review eats up to 45 minutes, and critical vulnerabilities linger for 60–90 days — while industry data puts the average breach cost at $4.45M and finds that one in five pull requests introduces a new flaw. Kalpita CodeGuard was engineered to erase that remediation lag. Acting as an autonomous DevSecOps engineer, it uses Azure OpenAI to intercept each commit, map the flaw to known CVEs, and generate a secure patch bundled with a plain-English explanation — then opens a verified pull request for a human to approve, in under three minutes. Built at a Kalpita hackathon and developed into a complete platform, CodeGuard makes teams ship faster and safer at the same time.
Product profile
At a glance
Kalpita CodeGuard is a Kalpita product, built for the teams that feel the cost of insecure code first: enterprise software groups running high-velocity CI/CD pipelines under strict compliance. It is modeled and tuned against a demanding baseline — a 500-developer organization generating roughly 200 vulnerabilities a month.
- Product
- Kalpita CodeGuard
- Industry
- Technology, SaaS, financial services, healthcare — anywhere compliance, data security, and release speed collide.
- Users
- CISOs, DevSecOps engineers, and enterprise development teams that cannot trade security for velocity.
- The cost of the status quo
- fixing a flaw in production is ~30× more expensive than fixing it at the keyboard, with security bottlenecks delaying releases and audits run on spreadsheets.
- Origin
- Built at a Kalpita hackathon, developed into a full product
Tools & technologies
The stack behind the remediation engine
- Frontend
- Angular 19 · TailwindCSS — analytics dashboard, leaderboard, compliance scoring
- Backend
- C# · .NET 10 Web API · Entity Framework Core
- Database
- Microsoft SQL Server — continuous audit trail
- AI engine
- Azure OpenAI (GPT-4.1-mini) — root-cause analysis, patch & explainer generation; multi-model ready
- Integration & auth
- GitHub API · GitHub Webhooks · JWT · SHA-256
The challenge
The problem we solved
Critical vulnerabilities sat unpatched for 60–90 days while senior engineers spent up to 45 minutes per pull request hunting for flaws.
The team mapped the friction points that make application security slow, costly, and unloved — then built to remove each one.
60–90 days
finding a bug is easy; fixing it takes time. A 60-90-day patch delay on critical vulnerabilities leaves organizations exposed.
45 min / PR
senior engineers spend up to 45 minutes per PR hunting for flaws — draining roughly $2.4M a year in a 500-developer org.
Context loss
developers are forced to research CVEs and guess the right fix, breaking flow and context.
No live view
leadership relies on nightly batch scans and manual spreadsheets, with no continuous audit trail.
The solution
An autonomous DevSecOps engineer inside the pipeline.
CodeGuard runs a seven-step autonomous workflow that keeps a human in command at the only step that matters — the merge.
AI fix generation
secure code patches, not passive alerts.
Multi-language SAST
scans and patches across tech stacks.
Plain-English explainers
demystify each CVE so developers learn while they merge.
Automated PR workflow
zero manual steps from detection to fix branch.
Developer leaderboard
gamifies security; +100 points per merged fix turns a chore into a win.
Online ephemeral scanner
on-demand scanning with no permanent code retention.
Real-time risk dashboard
live vulnerability trends and organizational risk.
Compliance scoring & report import
pulls in existing scanner reports and tracks continuous compliance.
Full DevSecOps coverage
IDE plugins (VS Code, JetBrains), Azure DevOps/GitLab, Jira/Slack alerting, IaC and container scanning, SBOM generation, and secret scanning, with multi-model AI.
Enterprise controls
multi-tenant SaaS with federated SSO (Azure AD, Okta), RBAC, custom policy packs, Compliance Autopilot, and Bring-Your-Own-Key/Model support.
The workflow
Seven steps from vulnerable commit to merged fix
CodeGuard runs a seven-step autonomous workflow that keeps a human in command at the only step that matters — the merge.
Commit
the developer pushes code to the repository.
Webhook
a native GitHub webhook instantly triggers a real-time scan.
Classify
the engine identifies the flaw, maps it to known CVEs, and grades severity.
AI fix generation
Azure OpenAI analyzes full application context and generates the exact secure patch.
PR creation
CodeGuard opens a fix branch and a pull request with the patched code and a plain-English ’what and why.’
Review
the developer reviews the diff, confirms business logic is intact, and approves the merge.
Score
the organization’s risk score drops, and the developer earns +100 leaderboard points.
Inside Kalpita CodeGuard
Results
What CodeGuard delivers, measured
Every number below comes from the platform’s own benchmarks, modeled against a 500-developer organization generating roughly 200 vulnerabilities a month.
MTTR
90%
vulnerability resolution from 60–90 days to 3–7 days.
PR review time
91%
security reviews from 45 minutes to 4 minutes with AI assistance.
Senior hours reclaimed
70%
70% of senior review hours reclaimed from manual code audits
Cost avoided
~$2.4M
~$500 saved per fixed vulnerability, modeled at ~$2.4M a year for a 500-developer enterprise
Commit to PR
< 3 min
under 3 minutes from vulnerable commit to AI-generated pull request — running asynchronously, never blocking CI/CD
Compliance
Continuous
a live risk dashboard and audit trail replace nightly batch scans and spreadsheets.
Conclusion
Shipping fast and shipping securely stop being a trade-off.
CodeGuard embeds an autonomous AI agent directly in the CI/CD pipeline, erasing the friction between shipping fast and shipping securely. It teaches developers through plain-English explainers, rewards them through gamification, and gives CISOs the continuous audit trails and compliance tracking they need. Organizations build faster and sleep better, knowing their code is secure by design — one more product graduating from Kalpita’s hackathon-to-product pipeline.
FAQ
Frequently asked questions
See it live
See a vulnerability fix itself.
Book a 30-minute demo and watch CodeGuard catch a flaw, write the patch, and open a reviewed pull request — in under three minutes, on your stack.