06/22/2026
How SMBs Can Build an Enterprise-Grade Vulnerability Harness on a Shoestring Budget
Big tech companies like Cloudflare are changing how we do application security. In their recent Project Glasswing update, Cloudflare shared how they scaled automated code-auditing across hundreds of repositories.
Don’t rely on a single AI model or a single chat session. AI agents forget things when context windows fill up, and different models catch different bugs. Instead, the future is a Model-Agnostic Vulnerability Harness, an architecture that treats LLMs like interchangeable compute engines.
For Small and Medium Businesses (SMBs), you don't need a massive security budget to replicate this. Here is a lean, automated blueprint to build your own vulnerability harness using Serverless tech and GitHub Actions!
The SMB Serverless Blueprint 👇
Cloudflare's harness utilizes a two-stage approach: Vulnerability Discovery and Vulnerability Validation. You can easily replicate a lightweight version of this directly in your CI/CD pipeline:
1. The Trigger (GitHub Actions): Set up a workflow that triggers on every pull_request or on a nightly schedule (schedule).
2. Stage 1 - Discovery (Cloudflare Workers AI + Model A): Use a GitHub Action to bundle and pass changed code files into a Cloudflare Worker.
* Inside the Worker, call an LLM (e.g., Llama-3 via Cloudflare Workers AI) running a specific "Hunter" prompt to actively search for injection bugs, hardcoded secrets, or logic flaws.
3. State Management (Cloudflare D1 / KV): Don't let the model handle state, its memory will saturate. Instead, have the Worker stream raw findings into a lightweight, serverless SQLite database like Cloudflare D1. This provides instant persistence so a timeout doesn't ruin the run.
4. Stage 2 - Validation (GitHub Actions + Model B): CRITICAL LESSON: Cloudflare notes that 40%+ of raw findings are false positives. To fix this, set up a second, separate step in your GitHub Action.
* Pull the raw findings from D1 and pass them to a **completely different model provider or API** (e.g., Mistral or Claude). This model acts as an unbiased, adversarial "Validator" whose only job is to try and *disprove* the finding.
5. The Output: If a finding survives the validation gate, the GitHub Action automatically opens a triaged, high-confidence GitHub Issue for you to review.
The Alternative: Ultra-Low-Cost Local & Open Source Harness
Want to keep 100% of your code local, maintain absolute privacy, and avoid any API token costs? You can build this entire harness on a low-resource local machine or local build server using open-source models!
The Local Stack: Use tools like “Ollama” or “Llama.cpp” to host open-source, highly capable coding models locally.
The Models: Run “OpenCodeInterpreter”, “CodeLlama”, or “DeepSeek-Coder” (quantized to 4-bit or 8-bit to fit easily onto consumer-grade GPUs or even modern CPU-only mini PCs).
How it works: Set up a local runner (like a self-hosted GitHub Actions runner on an office machine).
Task “OpenCodeInterpreter” to act as the "Hunter" engine mapping out vulnerabilities.
Task a different local model, like “Llama-3-Instruct”, to act as the independent "Validator."
đź’¸You get zero cloud inference costs, total protection of your intellectual property, and a rigorous double-check pipeline running entirely in-house.
Key Takeaways from Cloudflare's Architecture:
Treat Models as Commodities: Cloudflare designs its system so they can swap models instantly if a provider updates weights or shifts pricing. Build your code to accept any LLM endpoint.
Keep Context Small: Focus your agents. Pass only small chunks of relevant code and file architectures rather than doing a naive "read all files," which causes AI hallucinations.
Start Small: Cloudflare recommends starting with a simple "Recon, Hunt, and Validate" loop. Don't worry about complex dependency cross-tracing until your basic single-repo pipeline is running cleanly.
Stop relying on basic static analysis (SAST) tools that throw thousands of un-triaged warnings. Build a self-validating harness, cut the noise, and secure your code on a startup budget!
Read the full Cloudflare engineering breakdown here: https://blog.cloudflare.com/build-your-own-vulnerability-harness/
We break down the technical architecture behind our multi-stage vulnerability discovery harness and automated triage loop. Learn how we manage state controls, squash false positives through adversarial review, and route around LLM context limits.
