Cloudflare's Security-Audit Skill Gains 1,249 Stars in a Day

Cloudflare's security-audit-skill repository gained 1,249 stars on GitHub on Sept. 16, 2026, pushing its total past 6,055 three months after the company published it. The repository, released under the MIT license, is not Cloudflare's production vulnerability-hunting system; it is, in the words of chief security officer Grant Bourzikas's June 18, 2026 post on the Cloudflare blog, "the initial skill used to develop the harness," cleaned up for public release but otherwise close to what Cloudflare ran internally.

What the released skill actually does

The public repository is a roughly 450-line instruction set that turns a coding agent into a security auditor through a seven-step sequence: three parallel agents map a codebase's architecture, per-attack-class "hunter" agents try to break it, adversarial validators try to disprove each finding, survivors become a human-readable report and a machine-readable findings.json, and a fresh agent re-verifies every surviving claim before it reaches an engineer. Bourzikas's post says a single run of that process typically catches only about half of what repeated runs turn up together, which is why Cloudflare built a second system on top of it.

The system it grew into

That second system, the Vulnerability Discovery Harness, is not part of the GitHub release. Bourzikas's post gives it real scale: it scanned 128 repositories, generated 20,799 raw candidate findings, and passed 12,057 of those through validation. A companion Vulnerability Validation System consolidated results across 145 repositories to 13,841 total findings, then deduplication removed 5,442 duplicates, leaving 7,245 actionable findings that went to Cloudflare's engineering teams. A single-repository run takes 3 to 4 hours on average, the post says, with a worst case above 14 hours.

Metric	Count
Repositories scanned	128
Raw candidate findings	20,799
Findings after validation	12,057
Actionable findings sent to engineers	7,245

1. Raw candidates21K findings
2. Survived validation12K findings
3. Sent to engineers7245 findings

Source: Cloudflare Blog, Build your own vulnerability harness, accessed 2026-09-16

Nobody outside Cloudflare has checked the numbers

The StartupHub.ai write-up published the same week as Bourzikas's post covers the same architecture and the same phase breakdown, but adds no external verification of the totals; it restates Cloudflare's own account rather than checking it against, for instance, a third-party audit of the findings Cloudflare says it fixed. Every number in this story, the repository count, the candidate count, the deduplication figure, comes from Cloudflare describing its own tool's output, with no named external party confirming any of it.

Where it fits next to a crowded field

The skill format itself is now common enough to have its own competitive traffic. OpenClaw's rapid growth to 388,000 GitHub stars came with its own security lapses inside community-built extensions, a reminder that a tool's popularity and its security record move independently. Cloudflare's release carries seven open issues and 363 forks as of Sept. 16, 2026, modest next to OpenClaw's scale but enough that outside developers are already testing the skill against their own codebases rather than just reading about it.

Cloudflare has not said whether it will publish the Vulnerability Discovery Harness itself, or the model-agnostic orchestration layer Bourzikas's post describes as the system's "lasting component." Until it does, the GitHub repository remains a demonstration of the starting method, not the system that produced Cloudflare's own numbers. It joins a run of agent-tooling repositories gaining traction the same week, including a GitHub-trending inference engine that fits a 744-billion-parameter model in 16GB of RAM, all published without independent benchmarking of their core claims.