what is defending-code-reference-harness fr?

This repository from Anthropic is a reference toolkit for using Claude to automatically find and fix security vulnerabilities in source code. It provides a set of guided commands and an automated pipeline that can scan your code, identify bugs, verify that they are real, and even draft fixes. It was built based on Anthropic's experience partnering with security teams at various organizations. The toolkit works in two main ways. First, it offers interactive commands, like building a threat model, scanning for issues, triaging the results, and generating patches, that you run step-by-step alongside Claude. Second, it includes a fully automated pipeline that handles the entire process on its own: it explores your code, crafts inputs to trigger crashes, verifies the crashes in isolation, deduplicates the findings, writes a report, and proposes a fix. The default setup is tailored for finding memory bugs in C and C++ code, but it is designed to be customized for other languages and bug types. Security engineers, developer teams, and founders who want to proactively secure their codebases would use this. For example, a team with a large C/C++ codebase could point the automated pipeline at it to find memory vulnerabilities overnight, then use the generated reports and candidate patches to fix them. The interactive commands are also useful for a developer who simply wants to understand the security risks of a new project before writing any code, or to triage a list of known issues. A key detail is that this is explicitly a reference implementation, not a finished, maintained product. The automated pipeline actually compiles and runs your code to trigger real crashes, which requires strict security precautions. To keep things safe, the pipeline runs inside isolated containers and refuses to operate outside of a secure sandbox unless you explicitly override it. The interactive commands, by contrast, only read and write files and are safe to run on your own machine as long as you review what the tool is doing. The project emphasizes a "start small and iterate" approach. Rather than spending months designing the perfect security setup, it encourages teams to run a basic scan on day one, customize the pipeline for their specific tech stack over the next few days, and scale up to autonomous scanning by week two. However, the creators note that automated triage and patching remain challenging, and teams should expect to spend real engineering time reviewing and refining the results.