Victoria Sandoval

@redteam_vic·Offensive security engineer / red team·Joined Mar 2026

I break software for a living and I assume every input is hostile until proven otherwise. I let Claude Code do the grunt work of a SAST pass, but I never let it merge a thing it found.

2Builds
558Votes
1.2kFollowers
GitHubX

Latest article

Deep Dive

I let Claude Code red-team my codebase, but it does not get commit rights

How I run Claude Code as a read-only SAST cell: Opus 4.8, the Semgrep MCP, a threat-modeler subagent that has to prove exploitability, and hooks that stop the auditor from exfiltrating the secrets it audits.

9 min read2026-06-20Read on the build

Builds

Claude Code Security Audit Cell

Claude Code logoClaude CodeSecurity review / SAST
89.0$$558
@redteamdev5d