free-pi 的 Defense Flash：當編碼模型拒絕協助你自己的 AppSec 工作
When your coding model refuses your own AppSec work
free-pi 正為已登入 GitHub 的用戶在 /model 選擇器加入可選的 Defense 區域，首個模型 Defense Flash 是支援工具使用、上下文長度為 1M-token 的推理模型，供合法安全工作使用。它按一般模型的方式扣除點數；目前尚未公佈測試，因此文章聚焦負責任的使用方式，而非基準測試。
If you do application security, you have probably watched a coding model decline something routine: writing a proof of concept for a bug in your own staging app, or explaining how a flaw in your own handler would be exploited so you can fix it. That leaves the defender with less help than an attacker would have.
I work on free-pi, a free terminal coding agent. We are adding an opt-in Defense section to the /model picker for signed-in GitHub users. The first model is Defense Flash: a reasoning model with tool use and a 1M-token context, chosen for lawful security work that general models often refuse. It is billed from normal credits like any other model. We have not published tests of it, so this post is about using it responsibly, not a benchmark.
Ground rules
Use it for:
- systems and code you own,
- employer or client systems where you have written permission to test,
- in-scope bug bounty targets, following the program's rules,
- software you own or may lawfully analyze (free-pi's
/reverse-engineer-anythingcommand covers native binaries, JS and Electron apps, APKs, .NET and websites).
Do not use it on anyone else's systems. Computer misuse laws apply whichever model you pick, and a bounty program's scope list is a boundary.
Habits that help
- State the context: who owns the system and what you are authorized to do.
- Aim at find-and-fix: ask for the minimal patch and a regression test.
- Test in isolation: a local container or disposable staging copy, never production, no real credentials. free-pi has no OS sandbox for normal sessions.
- Verify claims: reproduce a reported flaw before you file it, and review every generated patch.
- Keep the scope in the session: for bounty work, paste the program's scope text.
Pairing
free-pi bundles the audit method and checklists from the security-audit skill, run in a single agent, so validate each finding yourself. /reverse-engineer-anything covers software you may lawfully analyze. The Defense section is where to look when a general model declines the lawful part.
More at freepi.ai.
來源：DEV Community · dev.to