securelayer7/sandyaa
Stack:
TypeScript
Claude Code
Autonomous code auditor that orchestrates Claude (and optionally Gemini) to analyze a codebase, trace data-flow, and write a working proof-of-concept for every confirmed vulnerability — no API key required.
Why it's interesting
It doesn't stop at flagging: eight recursive verification passes and an attacker-control filter prove exploitability before the report is written. It has already led to two public CVEs in Spring AI — a tougher test than any demo.