You run the scanners, you own the backlog, and you already know most of what the vendors are selling. This is where I build AI security tooling in the open: the Semgrep triage that actually decides, the pipeline that refuses to publish without me, and the demos where it breaks. Running code and honest limitations, not slideware.
A five-agent newsroom that researches, drafts, reviews and publishes my posts, gated by four taps from my phone.
Scoring Semgrep findings by probability-of-real, cheaply enough to run inside a pull-request check.
My self-hosted Hermes-Agent: persistent memory, MCP tools, and the runtime under Scribe.