Real static analysis (Semgrep) for detection, Claude for triage and fixes — not a freeform AI vulnerability guess.