Pinned Loading

1. wp-plugin-auditor wp-plugin-auditor Public

   Static analysis for WordPress plugins — six pattern checks for broken access control (CWE-862), from unauthenticated AJAX to weak REST permission_callbacks and IDOR. Built with tree-sitter.

   Python

2. reconductor reconductor Public

   All-in-one recon aggregator for the early stages of a penetration test — orchestrates subfinder, httpx, naabu, nmap, whatweb and feroxbuster into a single pipeline, with AD detection, real-IP disco…

   Go

3. secretpulse secretpulse Public

   Scans full git history for hardcoded secrets and validates whether each one is still live via read-only API checks — not just detection, confirmation.

   Go

4. bolahunter bolahunter Public

   Go-based CLI tool for testing REST APIs against BOLA/IDOR, JWT auth bypass, and mass assignment vulnerabilities — parses OpenAPI specs, tests cross-user authorization with body-diff confirmation, a…

   Go

5. portfolio-site portfolio-site Public

   HTML