🌊 Lagune is your security copilot as you build, your Blue Team when you audit, whether you're a developer or not (no API key needed).
Command
Establish or update the project's security charter, the safe-by-default principles every later phase must respect. Reads the project's files to learn what it is and uses, weighs any description you give against them, and asks when something is unclear.
Command
Detect what the system actually does by reading the code, and map the security-relevant findings (login, uploads, payments, data exposure, and so on) with the evidence later phases need. Scans the whole project, named files, or a focused scope.
Command
Apply the defense plan's fixes to the code, safely and one at a time, then record what was applied and what is left. Reads the plan and the charter, then hardens every fix, the fixes, files, or directories you name, or a priority you choose.
Command
Do the work the prompt asks for, with security guarding the build as it happens. Loads the charter, matches the security knowledge the work touches, builds safe-by-default, then checks its own result against what it used.
Command
Turn what detect found into the defense plan, one fix per finding, each rated by CVSS v4.0 (category, CVSS, priority) and tied to a charter principle. Reads the detect map and the charter, then plans every finding, named paths, or a concern you describe.
Command
Prove detected findings with runnable, defense-only evidence. For each finding the detect map carries, it writes a safe-path JavaScript test and a self-contained advisory under .lagune/proofs/. The test asserts secure behavior, never an exploit.
Command
Repair Lagune's internal tracking so each item stays whole when files are renamed or moved. A maintenance pass, not a security phase. It reads every artifact and the current code, then rewrites the tracking map across all phases in one pass.
Command
Specialize Lagune in a security area from a source or topic you give it, distilling it into a new on-demand sub-skill the detect and verify phases load later. It writes a focused, language-agnostic, defense-only knowledge module, never an exploit.
Command
Prove each applied control holds by confronting the hardening record with the code, writing each verdict back into that record, then standing the findings proven closed out of the chain. Read-only on your code, it writes only Lagune's own chain.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: