Hermes Agent Adds Official Security Plugin

This is a meaningful upgrade for agentic coding workflows: the value is less “AI finds bugs” than “AI shows which findings are reachable and why.”

• –Threat-model-first scanning prioritizes routes, inputs, shell commands, SQL, deserialization, authentication, and webhooks.
• –Candidate findings retain evidence, test results, rejected hypotheses, and coverage gaps, making reviews more auditable than generic LLM suggestions.
• –Standard, deep, and diff modes give developers a practical path from quick pull-request checks to broader repository audits.
• –The plugin complements SAST and human review rather than replacing them; test confirmation executes repository code as the current user and is not sandboxed.
• –Privacy requires scrutiny: the configured model provider receives reviewed code, while dependency metadata may be sent to OSV and deps.dev.