fraim

Working on Fraim, open-source agents for cloudsec and appsec engineers to complement existing deterministic scanners. Born out of our 3 years of learnings building such scanners for IaC. Turns out in the real world policies are subjective enough to make this hard. Examples: - Policies are frequently subjective. Hard to codify, but LLMs can evaluate them more like a security engineer would. "IAM policies should use least privilege." What is "least" enough? "Admin ports shouldn't be exposed to the Internet." What's an admin port? - Security engineers are stretched thin. LLMs can watch PRs for potentially risky changes that need closer human review. "PR loosens authz/authn." "PR changes network perimeter configuration." - Traditional check runs (SAST, IaC, etc.) flood PRs with findings. Security doesn't have time to review them all. Devs ten

We built Fraim to help security teams harness the power of LLMs without having to worry about all the complex glue and infrastructure. Fraim is an open-source project that provides a modular, extensible framework for easily integrating LLM-driven workflows into common security processes such as vulnerability triage, misconfiguration detection, and automated remediation suggestions. Security teams often want the productivity boost of LLMs, but find themselves bogged down by handling API integrations, structured data management, error handling, workflow chaining, and tool integrations. Fraim abstracts all these challenges away, enabling teams to quickly create powerful, custom workflows that output standardized SARIF reports. Currently, Fraim supports code repositories as input, but we're actively working on additional integrations such as