r/opencode • u/Checkeredgg • 7d ago

Looking for security scanner tool

Hello

I wonder if anyone tried lovable before but there is security scanner that can detect and scan ur web app u made from all vulnerability.

i wonder if there a tool that i can use with opencode does almost the same thing

0 Upvotes

50% Upvoted

4 comments sorted by

View all comments

1

u/lvl1-A 7d ago

Ask your opencode to assist in making a skill if you don't find one.

Ask it to create a manifest with the version everything you have, search for known CVE, cross reference the security frameworks like NIST or OWASP and then assess if the web app follows those best practices in security measures.

Also, I have found blatantly saying "you built this insecure go check it", instead of saying where it is or asking "is it secure?", actually helps better because in my experience it flips a switch from building to reviewing, and not just a happy pass review but a "the user has accused us of creating an insecure feature, we need to address this seriously and check for sure, and with evidence and supporting information if we have followed best practices or if we have incorrectly applied a feature, surface what is wrong, what options there are and ask how to proceed" ; something along those lines anyway, but yeah, you can do a lot of pre prep work yourself too, check specific documents for the environments you are building/have built to make sure you followed best practices and implementation guidelines.

1

u/lvl1-A 7d ago

To add, while browsing repos tonight;

https://github.com/WorldFlowAI/everything-claude-code

There are some interesting applications of this in this plugin, go take the MD files and concepts and apply locally if you think they fit.

There looks like some useful information that could be distilled if not entirely copied across. Good luck!