auto.hacker

Authorized, non-destructive website pentests — for sites you have proven you own.

auto.hacker runs a security scan (missing headers, reflected-XSS markers, CORS, cookie flags, CSP, directory listing, error disclosure, sensitive paths, unsafe HTTP methods, SQLi/traversal probes) against a website. It will not touch a host until the signed-in user has proven they control that exact host, and the proof is re-checked at scan launch and again in the worker right before the first request. The engine is ThreatCrush.

Live: https://auto.hacker.pit.world

The ownership gate (the one rule)

No scan reaches the engine until a per-user-per-host proof is found live. Token: HMAC(secret, "<user_id>:<host>"). Publish one:

• DNS TXT — _autohacker.<host> = autohacker-verify=<token>
• File — https://<host>/.well-known/autohacker-<token>.txt containing the token
• Meta — <meta name="autohacker-verify" content="<token>"> on the homepage

A host you cannot prove you own is refused. Every verification appends an immutable authorization log row. See the manifesto.

Surfaces

• Web (PWA): add target, proof + verify, launch scan, live SSE run stream, history, CSV/JSON export, account/profile.
• API: GET/POST /api/v1/targets, /targets/:id/verify, POST /api/v1/runs, /runs/:id, /runs/:id/stream (SSE), /runs/:id/export.{json,csv}, GET /api/v1/me/profile (401 logged out). Bearer ah_….
• CLI: autohacker add|proof|verify|scan|runs|report|targets.
• MCP: autohacker mcp (add_target, get_proof, verify, scan, runs, report, targets).
• TUI: autohacker tui.

Realtime + scheduled

A run streams live over SSE. A verified host can be subscribed to periodic (daily/weekly/monthly) scans; the worker runs them and emails a summary (Resend). Scheduled scans are the paid tier (CoinPay); on-demand scans of your own verified sites are free.

Honest scope

Authorized testing of your own verified properties, non-destructive checks only. Not a substitute for a manual penetration test.

Develop

bun install
AUTOHACKER_KEY=$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n') bun src/server.ts
bun test        # the ownership gate is the first and most-tested thing here

MIT.