AUTOMATED DETECTION AND PATCHING OF CODE DEPLOYMENT VULNERABILITIES USING GENERATIVE AI IN A CLOUD-NATIVE ENVIRONMENT

Cloud-native teams ship code to production within hours, and security checks in the delivery pipeline must keep pace. Static analysis tools used in these pipelines detect weaknesses by matching rules, produce warnings that developers learn to ignore, and none of the widely used open-source tools proposes a corrected version of the vulnerable code. This paper presents a framework that uses a fine-tuned generative AI model to detect, explain, classify and patch JavaScript vulnerabilities inside a cloud-native workflow. The DeepSeek-R1-Distill-Qwen-7B reasoning model is fine-tuned with low-rank adapters (LoRA) on a JavaScript subset of the CrossVul dataset that covers seven CWE classes. A distillation pipeline converts pairs of vulnerable and fixed code from CVE-fixing commits into four-part conversations, so that one inference returns the vulnerable code, an explanation, a patch and a CWE label. The model is exported in GGUF Q4_K_M format and published on Hugging Face. A Next.js dashboard scans repositories on demand, and a GitHub Actions workflow scans pull requests, comments on them and fails the check. The training set-up was validated with a ten-step run and the integration was tested on a small repository. The model described the SQL injection in one test file correctly, produced a questionable finding for another, and did not show a patch in either scan, so the paper makes no claim about detection accuracy or patch quality. A feature comparison with ESLint, Semgrep, SonarQube and CodeQL shows that the framework is the only one designed to give case-specific explanations and patches. A full training run and a benchmark evaluation are identified as the next steps.