open·kritt Review 2026: Self-Hosted AI Vulnerability Scanner
Pointing a model at a whole repository and saying “find the bugs” rarely works. I’ve tried. The findings come back vague, duplicated, and unranked — a pile of “potential XSS here” with no way to know what’s real. open·kritt is the open-source answer to that, and the team behind it has $1.5M in bug bounty payouts to prove the approach works. The project just hit 628 stars in under two weeks (created July 20, sitting at v1.2.0 when I pulled it). Yet it’s not another “AI code scanner” toy. It’s a self-hosted security research platform that turns a single vague instruction into dozens of small, well-defined agent tasks running in parallel — then de-duplicates, ranks, and validates what comes back. And because it ships as Docker Compose, you run it on infrastructure you own. That last part is why it earned a full review here. ...