auto.hacker

Authorized, non-destructive website pentests — for sites you have proven you own.

auto.hacker runs a security scan (missing headers, reflected-XSS markers, CORS, cookie flags, CSP, directory listing, error disclosure, sensitive paths, unsafe HTTP methods, SQLi/traversal probes) against a website. It will not touch a host until the signed-in user has proven they control that exact host, and the proof is re-checked at scan launch and again in the worker right before the first request. The engine is ThreatCrush.

Live: https://auto.hacker.pit.world

The ownership gate (the one rule)

No scan reaches the engine until a per-user-per-host proof is found live. Token: HMAC(secret, "<user_id>:<host>"). Publish one:

• DNS TXT — _autohacker.<host> = autohacker-verify=<token>
• File — https://<host>/.well-known/autohacker-<token>.txt containing the token
• Meta — <meta name="autohacker-verify" content="<token>"> on the homepage

A host you cannot prove you own is refused. Every verification appends an immutable authorization log row. See the manifesto.

Surfaces

• Web (PWA): add target, proof + verify, launch scan, live SSE run stream, history, CSV/JSON export, account/profile.
• API: GET/POST /api/v1/targets, /targets/:id/verify, POST /api/v1/runs, /runs/:id, /runs/:id/stream (SSE), /runs/:id/export.{json,csv}, GET /api/v1/me/profile (401 logged out). Bearer ah_….
• CLI: autohacker add|proof|verify|scan|runs|report|targets|webhooks|webhook.
• MCP: autohacker mcp (add_target, get_proof, verify, scan, runs, report, targets, list_webhooks, create_webhook, test_webhook, rotate_webhook_secret, delete_webhook, webhook_deliveries).
• TUI: autohacker tui.

Webhooks

Customer webhooks via @profullstack/webhooks: add a URL on /account#webhooks, with autohacker webhook add <url> [events...], MCP create_webhook, or POST /api/v1/webhooks. auto.hacker POSTs signed CloudEvents (Standard Webhooks) for target.verified, run.started, run.completed, run.failed, run.refused and finding.created, to the account that owns the target, retried for about three days. finding.created carries severity and the check's title only, never the probe payload, probed URL or raw details.

Realtime + scheduled

A run streams live over SSE. A verified host can be subscribed to periodic (daily/weekly/monthly) scans; the worker runs them and emails a summary (Resend). Scheduled scans are the paid tier (CoinPay); on-demand scans of your own verified sites are free.

Honest scope

Authorized testing of your own verified properties, non-destructive checks only. Not a substitute for a manual penetration test.

Develop

bun install
AUTOHACKER_KEY=$(head -c32 /dev/urandom | od -An -tx1 | tr -d ' \n') bun src/server.ts
bun test        # the ownership gate is the first and most-tested thing here

MIT.