I built a security scanner where an AI reviews every finding

Every security scanner I've used has the same problem: the first run produces a wall of findings, half of them aren't real, and after a week nobody opens the report anymore. The scanner did its job. The humans gave up.

So I built OpenRouting. It runs proven open-source scanners on your repository, then has Claude, via Amazon Bedrock, review every finding before you see it: is this real or a likely false positive, how sure is it, what could go wrong, and what's the fix.

This post covers what it does today, what it deliberately doesn't do yet, and how the pricing works.

You sign in with Google or GitHub, connect a GitHub repository, and start a scan. Each finding in the dashboard comes with:

Each issue is tracked once across every scan. Mark something false_positive, accepted_risk or fixed and it stays that way, with who changed it and why.

I'd rather you know this before signing up:

The short version (a follow-up post covers the scanning sandbox in detail):

No subscription. You pay with credits, per workspace:

I picked credits over a monthly plan because small teams scan in bursts: before a launch, after a big merge, when a customer asks for a security review. Paying for what you run seemed fairer than a seat price.

I'd love feedback, especially on false positives it got wrong and checks you expected but didn't find. Comment here or reach me at hello@openrouting.si.