The Skill Cloudflare Uses to Secure The Web
Agent Engineer Accelerator - https://switchdim.s.gy/yt-ai-security-scoreboard I built a Next.js SaaS with 6 security bugs on purpose, three that classic scanners should catch and three of the kind AI coding agents actually write, then ran three rounds of tools against it: Gitleaks and Trivy, Claude Code's built-in /security-review, and Cloudflare's new open-source security-audit skill. Here's which tool caught which bug, what the Cloudflare skill cost to run, why scanners miss the bugs AI writes most, and three practical levels of security you can set up this week. SOCIALS X: https://x.com/robshocks LinkedIn: https://www.linkedin.com/in/robertoshaughnessy/ Instagram: https://www.instagram.com/therobshocks/ WORK & COLLABS info@switchdimension.com RESOURCES Cloudflare security-audit skill: https://github.com/cloudflare/security-audit-skill Build your own vulnerability harness (Cloudflare): https://blog.cloudflare.com/build-your-own-vulnerability-harness/ Claude Code Security Review: https://github.com/anthropics/claude-code-security-review Gitleaks: https://github.com/gitleaks/gitleaks Trivy: https://github.com/aquasecurity/trivy Lovable CVE-2025-48757 write-up: https://mattpalmer.io/posts/2025/05/CVE-2025-48757/ Next.js CVE-2025-29927: https://api.osv.dev/v1/vulns/GHSA-f82v-jwr5-mffw Shannon: https://github.com/KeygraphHQ/shannon Trail of Bits skills: https://github.com/trailofbits/skills OWASP ZAP: https://github.com/zaproxy/zaproxy Mozilla Observatory: https://developer.mozilla.org/en-US/observatory CHAPTERS 0:00 Intro 0:43 Why AI-Built Apps Break Differently 1:38 Meet Leakcast: 6 Planted Bugs 2:33 Round 1: The Free Scanners 3:35 Round 2: Claude Code's Built-In Review 4:30 Round 3: Cloudflare's Security Skill 6:37 The Control: One Plain Prompt 8:11 The Scoreboard 8:58 Three Levels of Pragmatic Security 10:48 Outro #AISecurity #ClaudeCode #CursorAI #Cloudflare #NextJS #WebAppSecurity #VibeCoding #AppSec #AIDevelopment #AgentDevelopment #OWASP #CyberSecurity #Gitleaks
