Astra writes a lot of security bugs too, the upside is that if you also use it to review the output it will find a lot (most?) of them.

This is one of the least talked about and most useful features in any harness I would say, the review feature. I have never not found issues (either security or implementation) running it, no matter the code base or language.