{
 "schema_version": 1,
 "generated": "2026-10-24",
 "id": "stijnswapped-myrqen--verify-local-app-security-candidates",
 "repo": "stijnswapped/Myrqen",
 "repo_url": "https://github.com/stijnswapped/Myrqen",
 "repo_slug": "stijnswapped-myrqen",
 "title": "Confirm security candidates in a local app",
 "page_title": "How to confirm security candidates in a local app with Myrqen",
 "summary": "Static analysis flags candidates, then your agent tests the running app and marks each one verified, refuted, or needs_review.",
 "who": "A developer with a TypeScript, JavaScript, or Python web app on their machine who wants a security check before shipping.",
 "problem": "Static scanners flag code that may be vulnerable but cannot show whether the running app actually behaves that way, so results are hard to trust.",
 "outcome": "A report that separates observed vulnerabilities from unconfirmed candidates, with evidence attached to every verified finding.",
 "steps": [
  "Run `npx myrqen link` once to install the Agent Skill for your coding agent.",
  "Open a terminal in your project folder and start the application locally.",
  "Run `myrqen auto --sync no` to keep the entire scan on your machine.",
  "Let the agent exercise the running app, then review the report for verified, refuted, and needs_review findings."
 ],
 "agent_prompt": "Using the Myrqen repository (stijnswapped/Myrqen) Agent Skill, run `myrqen auto --sync no` in <project path> against the app running at <local URL>. Expect an HTML, Markdown, JSON, or SARIF report listing each finding as verified, refuted, or needs_review. Verify that every verified finding includes the evidence the agent observed.",
 "agents": [
  "claude-code",
  "codex"
 ],
 "difficulty": "Intermediate",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "Myrqen will not tell you that you are secure, and any candidate nobody exercises stays needs_review.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "typescript",
 "requirements": [
  "A coding agent you already use, such as Claude Code or Codex",
  "Node.js 22 or newer and npx for the Agent Skill install",
  "A local project you own or are explicitly authorized to test",
  "Node.js 22 or newer and pnpm if you want to build from source"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": true,
 "score": 1.0,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/stijnswapped-myrqen/verify-local-app-security-candidates/",
 "md": "https://dedupedai.com/use-cases/stijnswapped-myrqen/verify-local-app-security-candidates/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/stijnswapped-myrqen--verify-local-app-security-candidates.json",
 "api_version": "v1"
}