When your coding model refuses your own AppSec work

The free-pi project, a free terminal coding agent, is adding an opt-in Defense section to its /model picker for signed-in GitHub users, starting with Defense Flash, a reasoning model with tool use and a 1M-token context aimed at lawful security work that general models often refuse. The model is billed from normal credits, and the project says it has not published tests, framing the release as guidance on responsible use rather than a benchmark. free-pi also bundles audit methods and checklists from Cloudflare's security-audit skill into a single agent, warning users to validate findings and to restrict use to systems they may lawfully analyze.

If you do application security, you have probably watched a coding model decline something routine: writing a proof of concept for a bug in your own staging app, or explaining how a flaw in your own handler would be exploited so you can fix it. That leaves the defender with less help than an attacker would have. I work on free-pi, a free terminal coding agent. We are adding an opt-in Defense section to the /model picker for signed-in GitHub users. The first model is Defense Flash : a reasoning model with tool use and a 1M-token context, chosen for lawful security work that general models often refuse. It is billed from normal credits like any other model. We have not published tests of it, so this post is about using it responsibly, not a benchmark. Use it for: /reverse-engineer-anything command covers native binaries, JS and Electron apps, APKs, .NET and websites . Do not use it on anyone else's systems. Computer misuse laws apply whichever model you pick, and a bounty program's scope list is a boundary. free-pi bundles the audit method and checklists from the security-audit skill https://github.com/cloudflare/security-audit-skill , run in a single agent, so validate each finding yourself. /reverse-engineer-anything covers software you may lawfully analyze. The Defense section is where to look when a general model declines the lawful part. More at freepi.ai https://freepi.ai/blog/using-defense-mode-responsibly .