If you built an app with AI, nobody has tried to break into it yet, except maybe a real hacker. Most companies pay for a security test once a year; this free, open-source tool, past 51,000 GitHub stars, lets you run one on every update. It reads your app's code to find the ways in, then opens your running app in a browser and attacks it: the login, the forms, who can see whose data. A hole only makes the report after it really broke in, with the proof attached.
Here's what it checks, how to set it up, and what to watch out for.
What it does for you
- Reads your code: maps every page, form and API route and spots the likely ways in.
- Attacks for real: tries injection, cross-site scripting, fake requests, broken logins and seeing other users' data.
- No exploit, no report: only holes it actually broke through make the list, so you skip the noise.
- Proof: a PDF and Markdown report with the evidence for each break-in, plus files your other tools can read.
- Runs on Claude with your own key; it can also run on every update through GitHub Actions.
Free, for your email
Get the full setup steps + the copy-paste setup prompt
The rest of this guide (3 more sections, 1 copy-paste prompt) opens right here. The setup prompt, one paste into Claude that sets it all up, comes by email only. Use your real address.
Unlocks: Setup (about 15 minutes, then about an hour per run) · The catch · Sources
50,000+ follow where these guides come from. No spam, reply “unsubscribe” any time.
