security-forge

Give Claude Code a repo and it maps the project, looks for real vulnerabilities, then runs the app to check the ones it finds actually work. It saves everything to disk and never touches the target's PRs or CI.

GitHub

Official source

Start locally with the CLI guide