local non-AI security for your app/site! For years I had a long .txt file with hundreds of manual security checks I ran before pushing a (client) app/site to live; I am really a rookie compared to the real cyber experts, but just covering the basics has saved us many times from malicious attacks on our infrastructure. With the sprawl of AI generated vibecoded apps (I love it, i think creating should be accessible, but so should be cyber safety) and AI coding tools, our code goes to LLM providers but we'd never know what exactly happens behind the scene, hype harness is just rules imo.
As i've started my phd and not building apps (anymore for a living;) I'd decided to open source my rule-based system with some easy onboarding; use it through CLI, NPM, MCP, skill/agent (whatever they might call it in a few years). Its super helpful as a free, open-source alternative to run these checks in your codebase. Having a non-AI solution that costs $0 tokens might not outperform a SOTA security model of a big company; but running internal blue/red hat pentests 24/7/365 should be the norm for a safer internet; having it open-source making it a whitebox system and I hope many people contribute their lists. Its not bulletproof but we score #1 on some public benchmarks among free tools (npm malware, PyPI malware and JS injection bugs) so thats encouraging
you can run it pre-commit hook, CI etc - working on a "watch" function that runs it live. Have some flags like --deep for a very intense pentest (SQLi, SSTI, SSRF, XSS, command injection) so be careful and only your own URLs. Also --ai opts-in a local Ollama (or if you want paid also fine) model to find things beyond my rules (the LLM never decides on findings). After you can pass it to you coding agent to fix it; thats up to you. maybe in future ill improve this UX but like to stay local-offline-first
anyway feel free to try and give feedback or do a PR if you have some ideas. no signup, $0, local, hackable; read more on the www: penthera.org for some research i've done to make it better/transparent
npx penthera --repo . <3 daan
Comments URL: [https://news.ycombinator.com/item?id=50379624](https://news.ycombinator.com/item?id=50379624)
Points: 1