Of course it is B). If you can use LLMs to find bugs and vulns in software you don't own, you certainly can use them to find bugs in software you _do_ own. They are amazing at that job.

Also, models like GLM 5.3 have zero guardrails in that regard ("find vulns in (...)" prompts just work)