“Most existing open-source SAST tools rely on regex patterns or LLMs”, this may be the case with new tools in the last 7 months but before then has definitely not been. (Bandit, semgrep, black duck, etc…)
I do like this as an intro project, but why did you choose to use Python source code as your validators and remediation? I initially assumed for llm.