Most scanners flag anything suspicious and leave you to sort out what's real. Mugiwara proves it instead. It generates a proof-of-concept exploit, runs it in an isolated container, and only marks a finding verified if the attack actually works. For verified issues, an AI patches a disposable copy and we re-run the same exploit to confirm it's blocked. Everything runs locally-your code never leaves your machine. V0: injection classes in Python. Feedback welcome, especially on false positives.
Hey Product Hunt 👋
This started as a joke. We asked a few friends if we could scan their GitHub repos, and almost every one had a real security hole sitting in it. Not bad developers -just the shortcuts all of us take at 2am.
What bothered us wasn't that the holes existed. It's that the tools meant to catch them are so noisy nobody reads the output. Two hundred warnings, most of them wrong, so you stop looking.
So we built MUGIWARA around one idea: don't report it unless you can prove it. It writes a proof-of-concept exploit, runs it inside an isolated container, and only calls something a vulnerability if the attack actually lands. Then an AI patches a disposable copy and we re-run the same exploit to check the fix genuinely holds.
Everything runs on your own machine, model included.
This is V0, built as students over the last few weeks. We'd love feedback, especially from anyone who's stopped trusting their security tooling — what would it take to earn that back?
Try it here - https://dashboard-seven-self-13....
Happy to answer anything in the comments 🏴☠️