NovaScan: AI-Driven DevSecOps Platform

The rapid evolution of Agile and DevOps methodologies have introduced severe administrative and cognitive bottlenecks for modern software engineering teams. Developers face the constant threat of alert fatigue from rigid static application security testing (SAST) tools creating excessive false positives. Industry reports indicate false-positive rates as high as 40-60% while Project Managers struggle with "Agile Administration Friction" spending an estimated 3-5 hours per week manually transcribing standup meeting notes into project tracking systems. This paper introduces NovaScan, an AI-driven dual-engine platform that addresses both inefficiencies through a single unified, event-driven orchestration architecture rather than two tools. The first engine, Automated Security Engineer, listens for GitHub Pull Request webhooks, analyzing raw code diffs with Large Language Models (LLMs) to generate dynamic contextual risk scores(1-10) followed by structured alerts in Slack, Jira, and Notion. The second engine, the Autonomous AI Scrum Master, consumes unstructured meeting transcripts extracting tasks entities using team roster resolution and output strict JSON structures for automated Jira ticket provisioning. Both engines share a common multi-tenant context-resolution layer, so that organizational credentials, team rosters, and historical activity are resolved once and reused across security analysis and agile automation alike. Preliminary evaluation on a synthetic test set of ten Pull Requests spanning SQL injection, hardcoded credentials, insecure deserialization, and path traversal vulnerabilities demonstrates a 90% vulnerability detection rate with an average end-to-end processing latency of 2.8 seconds and a false positive rate of approximately 11%, a substantial improvement over the 40–60% false-positive rates commonly reported for rule-based SAST baselines such as SonarQube and Snyk. NovaScan is built on FastAPI, MongoDB, Google Gemini Pro 1.5, and a Next.js dashboard, and is designed around strict multi-tenant credential isolation so that a single deployment can safely serve multiple organizations without cross-tenant data leakage. The system is aligned with UN Sustainable Development Goals SDG 08 (Decent Work and Economic Growth) and SDG 09 (Industry, Innovation and Infrastructure).