Get most of an enterprise AI security scanner for free with open-source repos
With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call.
Source
@mika_systems on X · 2026-10-21
Written in our own words. Credit to the original author. Link checked 2026-10-23.
What they did
With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call.
Result (as claimed)
One deep scan per repo plus a check on every change catches bad commits the day they land.
Tools they used
Cost: Claude Code: from $17/mo.
Set it up
Pick a contained repo or task
Start on a branch or side project where mistakes are cheap.
Install and configure
Set up Claude Code. Read what it can run on your machine and limit permissions where possible.
Run it on a real task
Give it a well-scoped issue and let it work. Review the diff like any pull request.
Add guardrails
Keep tests and CI in the loop, and never let an agent push to main or touch production secrets unattended.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Get most of an enterprise AI security scanner for free with open-source repos What the original author did: With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call. Reported result (as claimed by the author): One deep scan per repo plus a check on every change catches bad commits the day they land. Source: https://x.com/mika_systems/status/2112977357329863072 Tools they used: Claude Code Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Get most of an enterprise AI security scanner for free with open-source repos What the original author did: With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call. Reported result (as claimed by the author): One deep scan per repo plus a check on every change catches bad commits the day they land. Source: https://x.com/mika_systems/status/2112977357329863072 Tools they used: Claude Code Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Get most of an enterprise AI security scanner for free with open-source repos What the original author did: With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call. Reported result (as claimed by the author): One deep scan per repo plus a check on every change catches bad commits the day they land. Source: https://x.com/mika_systems/status/2112977357329863072 Tools they used: Claude Code Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
How to vibe code an app with Claude Code · How to use AI agents for security scans and threat intel · How to secure vibe-coded apps and agents
Related use cases
Security-audit a codebase with a skill where a second agent tries to disprove every finding
Cloudflare open-sourced its security-audit skill. Point a coding agent at a codebase and say "security audit this codebase": it maps trust boundaries, hunts attack types with parallel agents, has a fresh agent try to prove each bug wrong, saves findings as schema-checked JSON, verifies them against the source and writes a report.
Track security news against your exact stack with Claude Code and Grok Bot
A non-security founder had Claude Code list every platform, package, version and third-party dependency in his product, then gave that inventory to Grok Bot to keep stored and check against new vulnerabilities.
Scope an AI security audit to one folder so it doesn't burn your tokens
Cloudflare's open-source, MIT-licensed security audit skill installs with npx skills add and runs when you prompt "security audit this codebase". Because several agents double-check each finding it is slow and costly on big monorepos, so scope it to specific directories.
Write a Linux driver for an unsupported scanner by letting Claude watch the Windows driver
A GNOME developer wanted to scan his late mother's film negatives on a Plustek scanner that Linux no longer supported. He had Claude Code set up a Windows virtual machine with the scanner passed through, capture the USB traffic of the vendor driver, and compare it with Linux until scans worked. He then had Claude turn the scripts into a reusable hardware reverse-engineering harness.