{"slug": "when-your-coding-model-refuses-your-own-appsec-work", "title": "When your coding model refuses your own AppSec work", "summary": "The free-pi project, a free terminal coding agent, is adding an opt-in Defense section to its /model picker for signed-in GitHub users, starting with Defense Flash, a reasoning model with tool use and a 1M-token context aimed at lawful security work that general models often refuse. The model is billed from normal credits, and the project says it has not published tests, framing the release as guidance on responsible use rather than a benchmark. free-pi also bundles audit methods and checklists from Cloudflare's security-audit skill into a single agent, warning users to validate findings and to restrict use to systems they may lawfully analyze.", "body_md": "If you do application security, you have probably watched a coding model decline something routine: writing a proof of concept for a bug in your own staging app, or explaining how a flaw in your own handler would be exploited so you can fix it. That leaves the defender with less help than an attacker would have.\n\nI work on free-pi, a free terminal coding agent. We are adding an opt-in **Defense** section to the `/model` picker for signed-in GitHub users. The first model is **Defense Flash**: a reasoning model with tool use and a 1M-token context, chosen for lawful security work that general models often refuse. It is billed from normal credits like any other model. We have not published tests of it, so this post is about using it responsibly, not a benchmark.\n\nUse it for:\n\n`/reverse-engineer-anything` command covers native binaries, JS and Electron apps, APKs, .NET and websites).\nDo not use it on anyone else's systems. Computer misuse laws apply whichever model you pick, and a bounty program's scope list is a boundary.\n\nfree-pi bundles the audit method and checklists from the [security-audit skill](https://github.com/cloudflare/security-audit-skill), run in a single agent, so validate each finding yourself. `/reverse-engineer-anything` covers software you may lawfully analyze. The Defense section is where to look when a general model declines the lawful part.\n\nMore at [freepi.ai](https://freepi.ai/blog/using-defense-mode-responsibly).", "url": "https://wpnews.pro/news/when-your-coding-model-refuses-your-own-appsec-work", "canonical_source": "https://dev.to/dennisonbertram/when-your-coding-model-refuses-your-own-appsec-work-139c", "published_at": "2026-10-26 17:33:10+00:00", "updated_at": "2026-10-26 17:42:39.233678+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["free-pi", "Defense Flash", "GitHub", "Cloudflare", "security-audit skill"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/when-your-coding-model-refuses-your-own-appsec-work", "markdown": "https://wpnews.pro/news/when-your-coding-model-refuses-your-own-appsec-work.md", "text": "https://wpnews.pro/news/when-your-coding-model-refuses-your-own-appsec-work.txt", "jsonld": "https://wpnews.pro/news/when-your-coding-model-refuses-your-own-appsec-work.jsonld"}}