securaai

security reviews tend to happen late — right before a release, under time pressure, by whoever has bandwidth that week. securaai was built to make a first-pass review something you can run any time, from the terminal, without waiting for a scheduled audit.

it’s a cli tool where autonomous agents walk a codebase and its deployment configs, build a lightweight threat model of what’s actually exposed, map dependencies against known cves, and suggest concrete remediations rather than just flagging a cve id and moving on. the goal was to close the gap between “here’s a vulnerability” and “here’s what to actually do about it,” since the second part is usually where real audits run out of time.

the hard part was keeping false positives down — an agent that flags everything remotely suspicious is as useless as one that flags nothing, so most of the iteration went into grounding the threat modelling step in what’s actually reachable in a given deployment config, not just what’s theoretically possible.