Add VulnHawk - AI-powered application security scanner

[momenbasel]

Hi, I'd like to add VulnHawk to this list as a complementary tool for application security practitioners.

VulnHawk is an AI-powered SAST tool that focuses specifically on the vulnerability classes that traditional pattern-matching tools struggle with: business logic flaws, missing authorization on individual endpoints, IDOR/BOLA, and inconsistent security controls across a codebase.

The core idea is simple but effective - when analyzing a piece of code, VulnHawk includes related code from the same codebase as context. So if your API has 20 endpoints and 19 of them check user.role == 'admin' before performing an action, VulnHawk will flag the one that doesn't.

It supports Python, JavaScript/TypeScript, Go, Java, PHP (with Laravel-aware chunking), and Ruby (with Rails-aware chunking). It's available as a CLI tool and a GitHub Action, and it can ingest SARIF output from tools like Semgrep and CodeQL to perform deeper analysis on their findings.

Free to use with Claude Code, OpenAI Codex, or Ollama backends (no API key purchase required for CLI auth users).

https://github.com/momenbasel/vulnhawk

[Copilot]

Pull request overview

Adds VulnHawk to the repository’s curated “tools” listings under general security websites, making it available for inclusion in the generated README output.

Changes:

• Added a new tools entry JSON for VulnHawk with required metadata (name, remark, url)
• Marked the tool as free: true in line with existing entries’ optional “free” flag usage

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[paragonie-security]

Pull request overview

I am alarmed that Copilot decided to enable itself without our permission. Disgusting behavior, GItHub.

[momenbasel]

I've read it happens only if the PR author has Copilot access, and either their personal auto-review setting or a repo/org ruleset is enabled, then Copilot can get added automatically.
GitHub explicitly says repo/org automatic reviews apply to PRs created by people with access to Copilot[1]

[1] https://docs.github.com/en/copilot/concepts/agents/code-review

[paragonie-security]

If we wanted Copilot's opinion, we would have enabled it explicitly. This is an annoyance that I will spend my afternoon figuring out how to prevent.

[momenbasel]

Hi @paragonie-security - apologies for the Copilot noise. I did not enable Copilot on this PR; GitHub now auto-triggers the "copilot-pull-request-reviewer" on PRs in repos where the maintainer has not explicitly opted out, which I only learned after seeing your comment here. I share your frustration with GitHub auto-enabling this.

If it helps, you can disable it repo-wide by adding a .github/copilot-instructions.md or via Settings -> Copilot -> "Automatic review" toggle. Happy to address the substance of the PR (adding VulnHawk) if you are still open to it; otherwise feel free to close.