DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to triage source code findings and export SARIF with Redcell

Review code-scan findings mapped to file and line, then export them as SARIF.

Authorization notice. Redcell is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Who it is forAn application security engineer reviewing a public git repo or a local folder before a release.

The problemSource code review findings arrive as a long list with duplicates, and the ones that matter need to reach the CI or issue tracker in a standard format.

The outcomeA cleaned-up set of code findings, each tied to a file and line, with duplicates merged and dismissed items removed, exported as SARIF.

What you need first

  • Docker installed and able to pull the Kali image ghcr.io/martian56/redcell-kali:latest
  • uv and bun installed for the Python and frontend processes
  • A provider API key added in the Settings page (any LiteLLM-supported model)
  • Written authorization and a defined scope for every target you test

Steps

  1. Start the stack by completing the Quickstart: docker compose -f docker-compose.dev.yml up -d, uv sync --group live, uv run rc db upgrade, and uv run rc seed.
  2. Start the API, worker, and web app, then open http://localhost:5183 and sign in with admin / admin.
  3. Create a code-scan session that points at a public git repo URL or a local folder.
  4. Verify the findings that are real, dismiss the false positives, and merge duplicates the agent recorded twice.
  5. Export the report in SARIF format from the session.

Prompt for your agent

Using the repo martian56/redcell, create a code-scan session for <repo url or local folder path> and run it. Expected output: a SARIF file where each finding has a file and line. Verify that no dismissed finding appears in the export.

Caveat. The README describes code-scan sessions only for public git repos or local folders, so private repos need a local copy first.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page