Why I Built a Deterministic CPG-to-Nuclei Compiler in Rust

My background is in mechanical engineering. When I transitioned into cybersecurity, I brought a physical mindset with me: a system only works when the right forces are applied to the right mechanisms.

Today, the tech industry tends to treat AI like a magic wand. I see it differently. Large Language Models are a brilliant new technological commodity — much like electricity. You don't ask electricity to build a car; you use it to power the machines that do. You treat it with respect, implement security boundaries, and remember the golden rule of engineering: use the right tool for the right job.

When you apply this to automated security testing and agentic workflows, the current approach is fundamentally broken. We are asking language models to do precision machining. Agents get stuck in trial-and-error loops — guessing payload syntaxes, hitting CLI flag errors, and hallucinating schema parameters. It burns massive amounts of execution credits. Even worse, when an agent finally produces a functional template, it often causes state-mutation friction. It modifies application settings or pollutes enterprise databases without cleaning up, forcing maintainers to reject the pull requests to protect production environments.

To solve this, I decided to build the machine that the AI should plug into. I built and open-sourced cpg-nuclei-compiler (v1.0.0): a Rust-native compiler that converts Code Property Graphs (CPGs) into syntactically perfect ProjectDiscovery Nuclei YAML templates, backed by an isolated Docker execution harness.

Source (C/C++, Java, Go, Python) ──► Joern CPG ──► DataFlowSlice ──► Nuclei YAML ──► Docker Harness (TP/TN)

The 3-Tier Hybrid Model:

Rather than forcing an LLM to guess low-level exploit structures, this pipeline decouples high-level intent from exact code generation:

· The Intent (AI Layer): High-level reasoning maps target objectives. The AI acts as the electricity, deciding what to look for without wrestling with YAML formatting.

· The Machine (Rust Engine): The core compiler parses Joern CPG schemas and Single Static Assignment (SSA) dataflow paths. It computes taint graphs natively in Rust, generating 0%-error Nuclei YAML templates in milliseconds with minimal memory overhead.

· The Quality Control (Docker): The generated template runs inside an isolated container fixture to produce verifiable True Positive (TP) and True Negative (TN) reachability proofs before a pull request is ever submitted.

Real-World Proof: Solving Issue #11635 (PR #17007)

To validate this approach on a live target, I refactored the template for CVE-2024–51483 (changedetection.io Local File Inclusion) in ProjectDiscovery's official template repository (PR #17007).

Legacy automated checks were mutating settings (e.g., forcing html_webdriver mode) and leaving orphaned watches in the database. Using my compiled harness, I standardized an enterprise-safe lifecycle:

1. Snapshot: Captures CSRF tokens and records original application settings via GET requests.

2. Execute: Temporarily enables required drivers and executes the LFI path check.

3. Teardown: Issues explicit DELETE API calls and posts the original settings snapshot back to the server — leaving zero database artifacts.

The Bigger Picture

AI/LLM is an incredible commodity, but it requires structure and engineering discipline to be truly effective in enterprise security. By pairing deterministic graph compilation with closed-loop container verification, my goal is to clear template review backlogs, protect live environments, and give security engineers a reliable path from source code to verified security checks.

· GitHub Repository