LibreAI / Dev Tools / flounder
// devtools · adshao/flounder

flounder

Autonomous white-hat auditor — AI code review, bug-bounty research, exploit checks.

💎 Hidden gem★ 516 stars⑂ 74 forksAGPL-3.0updated 2026-10
▦ visual — this project's README ships no embeddable screenshot,
so here's a placeholder. The guide below is complete regardless.
// project facts

Project facts

flounder is an open-source dev tools project by adshao (adshao/flounder on GitHub). It has 516 GitHub stars and 74 forks, is released under the AGPL-3.0 license, and was last updated on GitHub on 4 October 2026.

Repository
adshao/flounder
GitHub stars
516
Forks
74
License
AGPL-3.0
Last updated on GitHub
4 October 2026
Category
Dev Tools
Listing
Hidden gem — a shorter page for a lesser-known project
Official site
Official site
// how it works

How it works

  1. Point flounder at code

    Give it a repository or target to audit.

  2. Let it hunt

    The auditor searches for vulnerabilities autonomously.

  3. Verify by execution

    Findings are grounded in actual execution, not guesses.

  4. Review the report

    Get verified findings with exploit context.

// features

Why people love it

Autonomous auditing

Hunts vulnerabilities without hand-holding.

Execution grounding

Verifies findings by running them.

Bug-bounty research

Built for hunter workflows.

Exploit construction

Builds proof-of-concept exploits.

AI code review

Security-focused AI review of code.

White-hat only

Designed for authorized auditing.

Advertisement
// run it

Run it yourself

  1. Step 1 — Clone the repo

    Download the source and move into the project folder.

    git clone https://github.com/adshao/flounder.git
    cd flounder
  2. Step 2 — Check the README

    Every project documents its own setup; start with install requirements.

    cat README.md | head -60
  3. Step 3 — Run it

    Follow the project's launch command — Docker, pip, npm, or a binary release.

    # see README for the exact launch command
// use cases

What you can build

Advertisement
// faq

Questions, answered

Is flounder free for commercial use?

AGPL-3.0 — commercial use allowed, but network-facing derivatives must share source.

Is it legal to use?

Only on systems you own or are authorized to test — white-hat only.

How is it different from a scanner?

It verifies findings by execution instead of just pattern-matching.

Do I need security expertise?

It automates much of the hunt, but interpreting results needs security knowledge.

Which languages can it audit?

Check the README for supported languages and targets.

// keep exploring

Similar tools

Dev Tools

Transformers

The model-definition framework behind modern AI — thousands of pretrained transformers for text, vision, and audio.

★ 166.9k starsApache-2.0
View guide →
Dev Tools

secure-code-game

Learn to code securely while having fun through our popular open source in-editor experience, designed for developers, students, and anyone curious about sec…

★ 2.8k starsMIT
View guide →
Dev Tools

Gradio

Build machine-learning web demos in Python within minutes — the fastest way to share a model with the world.

★ 43.7k starsApache-2.0
View guide →
Dev Tools

ralph-claude-code

An autonomous loop for Claude Code with intelligent exit detection, rate limits and a circuit breaker.

★ 9.7k starsMIT
View guide →
Dev Tools

pr-af

Open-source AI code reviewer — top-ranked on the Code-Review-Bench.

★ 645 starsCustom
View guide →
Dev Tools

oh-my-pi

A coding agent with the IDE wired in — LSP, debugger, subagents and code review in your terminal

★ 34.6k starsMIT
View guide →
// alternatives

Alternatives in Dev Tools

The most-starred other Dev Tools projects in the LibreAI catalogue — the realistic shortlist if flounder is not the right fit.

Get flounder

Free and open — grab the source, star the repo, and start creating.