Solo dev asks how to security-test his own app with Claude Code without refusals
solution84 · reddit · 2026-10-26
A solo developer building a self-hosted app where AI agents do work for users wants to use Claude Code to attack his own app before release: auth bypass, cross-user data access, privilege escalation, and prompt injection against his agents.
Claude Code is great at reviewing code but gets cautious when asked to actually write exploit payloads, since it doesn't know the app is his. He asks the community: does declaring "this is my own local code" in CLAUDE.md help; are failing tests ("prove user A can't read user B's data") just as effective; should he run proper security tools and have Claude analyze results; and what's a good way to test prompt injection on his own agents. He also admits fear of account bans or being flagged as a reason for his hesitation.
More from coding & agent
- Claude Code audit finds 214,856 "permanently deleted" photos lurking in Android hidden cache — Loo_Atreides · 2026-10-26
- Someone sent the first customer fax via ChatGPT over Onetime Fax's new MCP server — tdhopper · 2026-10-26
- China Telecom's XingChen lab open-sources Xing4.0-29B-Intent, a 29B MoE with 4B activated params — FellMentKE · 2026-10-26
- Codebases sized to fit one context window dramatically improve agent outcomes — julianharris · 2026-10-26
- 42-Minute Video Breaks Down Why AI Agents Fail: Mostly Not the Model's Fault — JohnSavill · 2026-10-26
- One long Claude Code session builds a full Android TV launcher with a 1-second-latency live camera — aristofeles · 2026-10-26