N - RAG Bot: AI-powered assistant for onboarding, CVE clarification & security learning

[DonnieBLT]

Idea N — AI Agent (RAG) for Intelligent Onboarding & Security Learning

One line: Replace the inoperative chatbot with a RAG-powered AI assistant for user/contributor onboarding, CVE result clarification, security education without disclosing vulnerabilities and other features.

Description

OWASP BLT currently has a completely commented-out LangChain-based chatbot implementation (website/bot.py, 202 lines) that was disabled due to issues. This idea will restore, refactor, and expand that infrastructure alongside making the website chatbot operational.

Core Use Cases

1. User & Contributor Onboarding

   • Guide new users through setup, explain platform features (BACON rewards, bug bounties, Adventures)
   • Help contributors navigate codebase, understand contribution workflows, and find issues to work on
   • Answer common questions about OWASP, security concepts, and BLT architecture

2. CVE Results Clarification (Idea A Integration)

   • Help maintainers understand CVE severity scores and CVSS metrics from automated scans
   • Provide context about vulnerability classifications without exposing raw vulnerability data
   • Explain remediation priorities and connect to relevant documentation

3. Security Education Support (Idea C Integration)

   • Answer security concept questions and guide users through Adventures and Labs
   • Provide learning resources without disclosing confidential vulnerability details
   • Maintain strict architectural boundaries: knowledge base uses ONLY documentation and educational content, NEVER Issue model data

[S3DFX-CYBER]

If possible can u add a timeline becoz this project isn't so compatible with a 350hr scope and training a rag model is hard but depends

[mdkaifansari04]

Sounds awesome though, could be quite useful in blt site, as the current chat window does not work, but doesn't reslies into 350hr frame, if needed to just implement the RAG. as most of the time we gonna use LLM and a single prompt is enough to make it end to end.

[karunarapolu]

@mdkaifansari04 not exactly, there is no docs so they have to be created. A full pipeline easily takes up 350 hrs, since we have to be embedding docs, labs, CVE's etc. Then accurately retrieving the information and then calling the LLM ( calling the LLM as you said won't take much time). Then there is making sure it doesn't leak confidential information and integrating it with the projects as well.

@S3DFX-CYBER here's the timeline

Phase 1 (Weeks 1–3): Chatbot Revival & RAG Skeleton
Phase 2 (Weeks 4–6): Knowledge Extraction & Onboarding Content
Phase 3 (Weeks 7–9): CVE Results Clarification (Safe Explanations)
Phase 4 (Weeks 10–11): Security Education Support
Phase 5 (Week 12): Hardening, Evaluation & Documentation

For now. Phase 3 and 4 will change based on final selected projects so they can be integrated with them