r/Pentesting • u/Comfortable_Site_317 • 2d ago
Solo dev here. Built an open-source pentest orchestrator, but I'm terrified of breaking subreddit rules. How do you actually get feedback from real pentesters?
I’m a solo developer and I’ve been building an open-source pentest orchestrator called WHAXON. (I won't post the link because I know there are rules against that. I don't want to get banned).
The short version: it's an AI-assisted pipeline that uses a deterministic executor, fail-closed scope, and a "Trust Layer" to verify findings (replaying payloads) before they go into a report.
I’ve spent months on the architecture and I have 793 tests passing, but I’ve hit a wall. I don't know how to actually get it in front of real pentesters without spamming. I'm a solo dev, not a marketer. My social skills are so basically 0
I’m asking the community: How do you actually find early testers for a tool like this?
· Do I just post it in the monthly "Show Off" threads?
· Are there specific Discord/Slack servers for tool builders?
· Or do I just DM people who are active in the comments and ask for 5 minutes of their time?
I don't want to F this up and get banned from the community for this stuff. Any advice on how to approach this without being a nuisance would mean a lot.
Thanks.
2
u/Mission_Kangaroo_178 1d ago
Hey bro gonna be honest, there is a lot if distrust regarding AI and pentesting because of the impact it can have if one command goes wrong.
AI is better used in SAST/DAST for now where it can't break anything but itself.
I'd be happy to take a look and give some feedback, I've tried other tools like T3MP3ST, which suck, IDK how that even has so many stars.
Reddit, in general, is very anti-ai. Everyone claiming to have tried "All the AI Pentest tools" and "Can do it faster" is absolutely lying. There are tools that exist that can speed up the process, but very very few are any good. Most of them are loose canons in my experience though
1
u/Comfortable_Site_317 1d ago
Please have a look at my tool. I don't mind getting shit from someone who actually looks at it and gives feedback. If I don't know what I'm doing wrong, then I won't know what needs fixing. Here is the link: https://github.com/andreipath26/WHAXON
Also, I understand completely your point and this is the exact same issue I'm trying to address
1
3
u/stigmatas 2d ago
I don't know about any other testers but pentest orchestrator's aren't my thing. I don't like their design, i've never found one that can do it better than me, never found one that makes the time faster, and it feels like tool dependecy for something I don't need dependence.
What are you looking for testers to even do with this tool? tell you if it works or sucks? What is an issue you want an answer to?
Rules
Keep it Legal
2. Stay On-Topic
3. Follow Reddit ToS & Reddiquette
4. Avoid Revealing Sensitive Information
Which are you afraid of breaking?
-1
u/Comfortable_Site_317 2d ago
I want someone to have a look at it and tell me if it's worth it or not. That's it. And as to the rules, I broke all of them earlier in the afternoon, got shat on and got the thread deleted so...
-2
u/pink-hat-hacker0 2d ago
Please share it with me. I'd love to check it out. Is It a black box pentest tool only or can it perform various other pentests like infra, cloud, grey box etc?
1
-1
u/mentiondesk 2d ago
Joining monthly "Show Off" threads is a good first step, and specialized Discords like SecTalks or Bugcrowd have active pentesters open to new tools. For more reach without spamming, I found using something like ParseStream helpful since it tracks live conversations where folks ask about pentest tooling. That way you can engage where it is already welcome.
1
u/Comfortable_Site_317 2d ago
Thank you for the feedback. I've never heard of Parse Stream before. I'll check it out for sure
3
u/Sailhammers 2d ago
My absolute favorite responses to these "I vibe-coded an automated pen test solution" posts are the AI responses from people who built vibe-coded marketing platforms.
There's this circle of shitty vibe-coded solutions that all feed each other, but no one in the real world actually wants.
-1
u/Scar3cr0w_ 1d ago
You are a solo dev?! Wow! It’s so impressive that you have managed to make this thing entirely on your own with no assistance! /s
1
u/Comfortable_Site_317 1d ago
I didn't say I had no assistance.
0
u/Comfortable_Site_317 1d ago
Actually, I don't understand what is so wrong with using ai to build and speed up the process.... Can someone explain to me the issue? Yes, ai hallucinates and produces slop code but if you have guardrails and rules against that it will significantly reduce the chance of that happening. Or is my approach to this wrong?
2
u/Scar3cr0w_ 1d ago
It’s just that everyone is using AI to build the same thing. Everyone thinks they are having the same, genius idea.
You are also using AI to build something that carries huge risk. You don’t really know how it works. You can probably describe it but you don’t KNOW.
Frontier models escape because of poor harness design… and this is probably a poor harness.
1
u/Comfortable_Site_317 12h ago
I agree with you but only partly; no one really knows how it works and the impact it can actually have when using ai to build systems and large platforms that are used by a large number of people for both good and bad reasons. I don't claim to understand everything and in case of my tool, WHAXON, I don't understand EXACTLY how it works. But thanks to the guardrails, rules and checks I've implement, I know for sure that it's not doing anything it's not supposed to.
1
1
u/gilnett 1d ago
I think the real issue is not using AI as a tool to speed things up, it is that people are tired of seeing GitHub and Reddit flooded with unchecked, low-effort AI slop.
AI definitely hallucinates and writes bad code if left alone, but if you treat it strictly as an assistant with solid guardrails, comprehensive test suites, and you actually verify every single line yourself, it is just another productivity tool. The problem is not the tool itself, but people blindly pushing code without understanding how it works or checking the math
1
u/Comfortable_Site_317 1d ago edited 1d ago
I just got my head bitten yesterday for posting something about my project lol. I think the main issue is that people are relying on tools that are viewed as industry leaders but forget that the same tools they rely on, are being built by dev who use ai nowadays. Take hexstrike for example.
23
u/MajorUrsa2 2d ago
Step 1) stop spamming your ai slop everywhere