RepoGuard: Harmonising Security and Functional Correctness in LLM-Guided Repository-Level Code Generation

Abstract

The rapid adoption of Large Language Models (LLMs) for code generation has significantly enhanced developer productivity while simultaneously increasing the risk of introducing insecure or functionally incorrect code into software repositories. This paper presents RepoGuard-Agent, an orchestration architecture that integrates LLM-driven repair with deterministic program analysis to automatically generate safer, compilable patches for vulnerable code. RepoGuard combines context retrieval (via AST-based repository analysis), prompt-engineered LLM correction, an Auto-Importer post-processor, and a hybrid validation oracle comprising ensemble Static Application Security Testing (SAST) scanners and dynamic unit tests. The proposed pipeline prioritises in-context learning and agent orchestration over resource-intensive fine-Tuning, thereby reducing infrastructure overhead while maintaining practical robustness. Evaluation on a synthetic multi-CWE script demonstrates that RepoGuard converges to a safer, functionally correct solution within Recursive Criticism and Improvement (RCI) iterations, successfully mitigating security vulnerabilities without compromising functionality. Results highlight the critical role of AST-based import repair and ensemble validation in addressing LLM scope myopia and static analyser noise. Finally, limitations, human-in-The-loop policies, and integration pathways for CI/CD deployment are discussed.