security-forge

security-forge is an agentic security and bug-bounty pipeline for Claude Code. It takes a repository, maps the project, looks for vulnerabilities, and runs the application to check that flagged issues are actually exploitable. Results are written to disk, and it never touches the target's pull requests or CI. The tool can be run via a slash command in Claude Code or from the terminal using orchestrate.py with options for a single repo, an entire GitHub org, or a local path. It supports incremental scans by analyzing only the diff after the first full scan, and it tracks previously reported bugs to surface only new ones. Findings are stored under knowledge/<target>/ with notifications, advisories, proof-of-concept exploits, and a findings.json file. Only CRITICAL and HIGH severity bugs are kept. The pipeline includes phases for comprehension, grep-based hotspot ranking, authorization analysis, agentic data-flow analysis, container-based verification, reconciliation, and notify-only reporting. It can also include additional repositories for dependency analysis, and it offers a web UI and Docker deployment for continuous scanning and report generation.