Ask HN: Which AI Security tool do you use and why for your repositories?
So I am new to the world of cybersecurity, and after some back and forth with AI, I chose to use a specific tool that was recommended for automated vulnerability detection & patching, but I think the issue I encountered is something common to all similar platforms that provide AI security fixes in 2026.
It proposed a fix to an issue labeled 'critical'. I gave the specific file and the fix to Gemini, and, it disagreed strongly.
My trust in the platform immediately degraded.
It shows in my thinking that AI security platforms for repositories are unreliable, unless you cross check every critical/high vulnerability as a human with another AI tool as well. For example, for another issue labeled 'High', the fix, I cross-checked, was correct in that case.
But that that one 'critical' issue, which turned out to be not a bug at all, and certainly not critical at all, has degraded my trust strongly in AI security platforms for automated vulnerability detection & patching. Note, to prevent confusion, with automated patching I mean automated pull requests with AI-proposed fixes, pending explicit human merging.
Now, I wonder what you guys use (instead, if at all), and how reliable your security tool(s) are, if at all, for automated vulnerability detection (& patching.)
Happy Coding!
Worldwide Wishes,
Behan
However, you can use an LLM to understand log files and tool output and most certainly to find a secure system architecture.
So I've always used my local rule-based checking systems (acts like a white/red-hat hacker on your codebase) and it flags out most vulnerabilities; not bulletproof - working on that. Made it open-source if you'd like to use it: https://github.com/danoszz/penthera - you can use it through your CLI or Cursor, Claude Code as MCP/skill/agent or via NPM: https://www.npmjs.com/package/penthera - we even have a 24/7 watch dashboard locally (first prototype)- read more about the project here: https://penthera.org ; I aim to make security more accessible for beginning/pro developers building their product with AI tools.
Our rules are research backed and score #1 on a few benchmarks, for now, I am sure paid tools (Snyk, Aikido, Wiz) have a much larger database and more advanced models; but for now rule-based (non-AI) is my bet for the future; we deeply need to understand how these models operate by opening up the engine and have these transparent rules. Let me know if this solves your challenge! its free ofc :)
Daan
happy (safe) coding
Daan happy (safe) coding