Check security, including AI-era risks

OpenThunder's Security Lens covers both the security issues every scanner looks for and the ones that only show up in AI-assisted code. It is keyless and local: it reads your code on your machine and reports findings with file:line evidence, never uploading your source.

Scan everything at once

openthunder scan

Runs the Architecture, Code Health, and Security lenses together. For just security:

openthunder security score        # 0-100 security score with sub-scores
openthunder security findings     # findings with severity + file:line evidence
openthunder security recommend    # each finding with exploit scenario, remediation, and a mission contract

AI security (the part other scanners miss)

AI-written and AI-integrated code has failure modes traditional SAST doesn't look for. OpenThunder checks the OWASP LLM risk classes , prompt injection, unsafe RAG, excessive agency, and MCP / tool exposure , alongside the classic ones (secrets, injection, insecure config, weak crypto):

openthunder ai-security           # AI/LLM-specific risks (prompt injection, unsafe RAG, excessive agency, tool risk)
openthunder traditional-security  # secrets, injection, insecure config, weak crypto

Fix what can actually hurt you first

A finding matters more in a file everything depends on. fusion re-ranks security findings by architectural blast radius, so you triage by real exposure instead of raw severity:

openthunder fusion                # security findings re-ranked by architectural blast radius

Gate merges on it

openthunder security check        # exit 1 on critical findings, new secrets, or unauthenticated protected routes

Run this in CI (see Use OpenThunder in CI) to block the security regressions AI changes most often introduce by accident.

Share the review

openthunder security review-pack           # a shareable Security Review Pack (Markdown)
openthunder security review-pack --html    # ... as HTML
openthunder security threat-model          # STRIDE threat model per critical flow

Honestly labeled, never inflated

Every finding carries its severity, confidence, and evidence; readiness is reported as readiness, not certification. OpenThunder is a security assurance module , it produces evidence about your code, dependencies, and configs. It is not endpoint antivirus/EDR and does not replace Defender or CrowdStrike.