I built a security scanner where an AI reviews every finding

Description and use

OpenRouting combines open-source scanners with Claude AI to review every finding, delivering verdicts, explanations, and fixes, reducing false positives and improving team efficiency.

Problem

Security scanners produce many findings, many false positives, leading to report abandonment.

Outcome

OpenRouting reduces false positives, provides clear fixes, and tracks findings across scans, enabling teams to act on real issues efficiently.

Workflow

• Sign in with Google or GitHub
• Connect a GitHub repository
• Start a scan
• OpenRouting runs SAST, secrets, IaC, PR, AI-agent, API collection, passive website checks
• Claude reviews each finding
• Dashboard displays verdict, confidence, explanation, fix, reviewer
• Mark findings as false_positive, accepted_risk, or fixed
• Generate downloadable Markdown/PDF report
• Optional: use AI assistant to search findings

Evidence

Every security scanner I've used has the same problem: the first run produces a wall of findings, half of them aren't real, and after a week nobody opens the report anymore.

Source

It runs proven open-source scanners on your repository, then has Claude, via Amazon Bedrock, review every finding before you see it: is this real or a likely false positive, how sure is it, what could go wrong, and what's the fix.

Source

Each finding in the dashboard comes with: A verdict: real issue or likely false positive, with a confidence score.

Source

Repositories are cloned, read and never executed: no installs, builds or scripts.

Source

No subscription. You pay with credits, per workspace.

Source