kulchankas

kulchankas/paranoid

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

4 good first / help-wanted issues · Python · last activity Sep 22, 2026

14 stars 3 forks 14 watchers Python MIT License
agent-skills ai-agents appsec claude-code codex cursor dast devsecops ethical-hacking llm llm-security owasp penetration-testing pentest secure-coding security security-tools vibe-coding vulnerability-detection web-security
View on GitHub
4 Open Issues Need Help Last updated: Sep 22, 2026

Open Issues Need Help

View All on GitHub
Re-score leaked_secrets_client_config after the publishable-key fix 25 days ago
enhancement help wanted
kulchankas/paranoid
14

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

Python
#agent-skills#ai-agents#appsec#claude-code#codex#cursor#dast#devsecops#ethical-hacking#llm#llm-security#owasp#penetration-testing#pentest#secure-coding#security#security-tools#vibe-coding#vulnerability-detection#web-security
Score idor_route_wiring against a model — the test that could break the +0pp result about 1 month ago
enhancement help wanted
kulchankas/paranoid
14

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

Python
#agent-skills#ai-agents#appsec#claude-code#codex#cursor#dast#devsecops#ethical-hacking#llm#llm-security#owasp#penetration-testing#pentest#secure-coding#security#security-tools#vibe-coding#vulnerability-detection#web-security
Independent proof: a target that doesn't advertise its own bugs about 1 month ago
help wanted good first issue
kulchankas/paranoid
14

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

Python
#agent-skills#ai-agents#appsec#claude-code#codex#cursor#dast#devsecops#ethical-hacking#llm#llm-security#owasp#penetration-testing#pentest#secure-coding#security#security-tools#vibe-coding#vulnerability-detection#web-security
Benchmark: add a multi-file app task, where the bug is in the wiring about 1 month ago
enhancement help wanted good first issue
kulchankas/paranoid
14

Your app is guilty until proven secure: an agent skill whose /hack-me breaks into your own running app, proves each bug with a real request, patches it, and re-verifies. Claude Code · Codex · Cursor.

Python
#agent-skills#ai-agents#appsec#claude-code#codex#cursor#dast#devsecops#ethical-hacking#llm#llm-security#owasp#penetration-testing#pentest#secure-coding#security#security-tools#vibe-coding#vulnerability-detection#web-security