# When your coding model refuses your own AppSec work > Source: > Published: 2026-10-26 17:33:10+00:00 If you do application security, you have probably watched a coding model decline something routine: writing a proof of concept for a bug in your own staging app, or explaining how a flaw in your own handler would be exploited so you can fix it. That leaves the defender with less help than an attacker would have. I work on free-pi, a free terminal coding agent. We are adding an opt-in **Defense** section to the `/model` picker for signed-in GitHub users. The first model is **Defense Flash**: a reasoning model with tool use and a 1M-token context, chosen for lawful security work that general models often refuse. It is billed from normal credits like any other model. We have not published tests of it, so this post is about using it responsibly, not a benchmark. Use it for: `/reverse-engineer-anything` command covers native binaries, JS and Electron apps, APKs, .NET and websites). Do not use it on anyone else's systems. Computer misuse laws apply whichever model you pick, and a bounty program's scope list is a boundary. free-pi bundles the audit method and checklists from the [security-audit skill](https://github.com/cloudflare/security-audit-skill), run in a single agent, so validate each finding yourself. `/reverse-engineer-anything` covers software you may lawfully analyze. The Defense section is where to look when a general model declines the lawful part. More at [freepi.ai](https://freepi.ai/blog/using-defense-mode-responsibly).