reddit · SideProject · 10-20 12:50 54 分 ← 返回列表

Added a “copy as prompt” button to my security scanner so Claude Code can fix the findings itself

Solo dev, no security team, most of my code is written by agents these days. A while back I built Forge (forge.magery.ai) mostly for myself: point it at a URL, it pokes at it like an attacker would and gives you a report in plain English. No codebase access, it only sees what’s public. The problem was what happened after the report. I’d get a list of 15 failed checks, read them, nod, and then... not fix most of them. Opening each one, translating it into instructions for the agent, pastin

五维评分

付费意愿

需求真实度

个人可落地

竞争空间

新鲜度

AI 分析

痛点：安全扫描报告与修复之间的空白：开发者拿到一堆失败检查项后，需要逐条翻译成给 AI agent 的指令，于是干脆不修

目标用户：没有安全团队的独立开发者，或每天用 Claude Code 等 AI agent 写代码的开发者

证据：I’d get a list of 15 failed checks, read them, nod, and then... not fix most of them. / the issue was never finding problems, it was the gap between the report and the fix.

变现：订阅制 SaaS（按扫描次数或项目数收费），上层可做 CI/PR 集成按仓库收费，企业版提供私有化扫描与合规报告

MVP：接现成扫描引擎（nuclei/ZAP/Semgrep）做后端，把失败项结构化成 JSON，一键生成 agent 可直接执行的修复 prompt，再加 24 小时过期的免登录分享链接；两周内可上线

竞品：Forge (forge.magery.ai)、Snyk、Semgrep、OWASP ZAP、Burp Suite、Aikido Security

摘要：独立开发者给自建安全扫描器 Forge 加了「copy as prompt」按钮，把失败的检查项打包成一段 prompt 丢给 Claude Code 自动修复，修复闭环从「一个下午」缩短到几分钟。作者的核心洞察是：安全工具的瓶颈不在发现问题，而在报告到修复之间的空白。帖子属于自建工具分享，没有收入或他人付费意愿的证据。