🛡️ Claude Code skill · Defensive security
securmyapp is a free, open-source, 100% defensive security auditor delivered as a single Claude Code Agent Skill. It runs 598 security checks across 12 domains — aligned with OWASP, CIS, MITRE and CWE — then walks you through fixing every vulnerability one by one, with human validation and real browser regression tests so nothing breaks.
Get started free Explore the 12 domains
Aligned with the reference security standards
Why securmyapp
Built for developers and vibe coders who don't master application security — no expertise required.
AI lets you ship an app in days — but security doesn't improvise. SQLi, XSS, exposed secrets, broken JWTs, SSRF and vulnerable dependencies slip past a developer in a hurry.
They're either too complex (experts only), too partial (one scanner, one job), or they dump a list of flaws and never help you fix them.
One gesture runs a complete audit, finds everything across 12 domains, then fixes each issue with you — explained simply, committed safely, and regression-tested in a real browser.
How it works
From a single /securmyapp, an autonomous audit runs first — then guided remediation, always with your approval.
Phase 1 · Autonomous audit
Phase 2 · Guided remediation
The vulnerability is described in clear language with its CWE / OWASP reference.
A concrete, minimal fix is proposed for the exact file and line.
The change lands as an atomic, reversible Git commit.
A real browser re-runs the flow against a healthy baseline (non-regression).
You decide: ✅ approve · ❌ reject (roll back) · ✍️ say exactly what to do.
Progress is saved, then securmyapp moves to the next finding.
Features
Type /securmyapp and the full audit starts on its own — no config, no security expertise required.
598 atomic checks across 12 domains, aligned with OWASP, CIS, MITRE and CWE — the whole codebase, not just the diff.
Every vulnerability is explained in plain language, then fixed with your approval — one by one, never in bulk.
After each fix, a real browser (Playwright) verifies the app still works, and every change is a reversible Git commit.
It verifies and repairs your own app. It never produces an attack procedure, payload, or exploitation method.
The analysis engine runs entirely on your machine over stdio. No code and no secret is ever sent to a third party.
One drop-in folder — no marketplace, no MCP server, no npm install. Optional scanners degrade gracefully when absent.
Progress is written after each fix, so you can stop the audit and pick it up again at any time.
598 checks · 12 domains
Every domain has its own deep-dive. Explore what securmyapp checks, the vulnerabilities it catches, and the standards behind it.
Coverage
Each check is tied to a recognized reference — OWASP, CIS, MITRE or CWE — and to a concrete fix.
Orchestrated scanners
Driven by a local, zero-dependency CLI that securmyapp runs directly. Each scanner is optional — it works with what's installed and flags what's missing.
🛡️ Strictly defensive
securmyapp is a 100% defensive tool. It verifies your own application and provides fixes. It never produces an exploitation procedure, an offensive payload, or an attack method.
🔒 Local & private
The analysis engine runs entirely on your machine over a local stdio protocol. No code and no secret is sent to any third party — by design.
FAQ
securmyapp is a free, open-source, defensive security auditor delivered as a single Claude Code Agent Skill. It runs 598 security checks across 12 domains, explains every finding in plain language, and guides you to fix each one — with mandatory human validation and real browser regression tests.
One command: clone the repository into your Claude Code skills folder — git clone https://github.com/mafady/securmyapp ~/.claude/skills/securmyapp — then ask Claude to "audit my app's security" (or type /securmyapp). No marketplace, no MCP server, no npm install, no reload.
598 atomic checks organized into 12 domains, aligned with OWASP (WSTG, ASVS 5.0, API Security Top 10, MASVS), CIS Benchmarks, MITRE ATT&CK and CWE. The severity breakdown is 32 Critical, 212 High, 265 Medium and 89 Low.
No. The analysis engine runs entirely on your machine over a local stdio protocol. No code and no secret leaves your environment — securmyapp checks and fixes your app exactly where it lives.
100% defensive. securmyapp is designed to verify and repair your own application and to provide fixes. It never produces an exploitation procedure, an offensive payload, or an attack method.
It is built not to. After every fix, a real browser (Playwright) checks the app against a healthy baseline, each change is an atomic reversible Git commit, and irreversible actions (secret rotation, resource deletion, DROP…) are blocked until you explicitly approve them.
Node.js 18+, Claude Code (terminal or the Claude Desktop Code tab) and a paid Claude subscription. Semgrep and the Playwright browser are recommended; Trivy, gitleaks, Checkov and nuclei are optional and used when present.
securmyapp is free and open source under the MIT license, including for commercial use. You only need Claude Code with a paid Claude plan to run it.
Get started
Clone the skill into ~/.claude/skills/, then ask Claude to audit your app (or type /securmyapp). The full audit starts on its own.
git clone https://github.com/mafady/securmyapp ~/.claude/skills/securmyappView on GitHub Browse the domains
New to Claude Code? Follow the step-by-step getting started guide.
Requires Node.js 18+, Claude Code, and a paid Claude subscription. Semgrep & Playwright recommended.