What are you using for testing vulnerabilities in your own code?

Claude gates on me like a stupid nanny with some cybersecurity bullshit (like bad actors haven't found a way around).