Hacktron AI

Hacktron ❤️ Open Source TL;DR: If you maintain an open source project, we want to give you Hacktron Review for free. We’ve spent the past few months using Hacktron to hunt 0-days in popular open source projects. For each finding, we replayed the offending PR through Hacktron Review to see if the bug could have been caught before merge. It caught every single critical. So giving maintainers the same capabilities as attackers would otherwise use against them felt like the right thing to do. We’re currently prioritizing actively maintained projects with meaningful downstream usage. https://lnkd.in/e_V6Umps

No, it's not too good to be true. Get security zen with the same code reviewer that found critical zero-days in NextJS, OpenAM, and Metabase.

When React2Shell hit last year, Vercel handled it brilliantly. To protect their users, they paid $50,000 for every WAF bypass researchers could find. We decided to participate, and ended up earning $170,000. TL;DR: All of our 5 bypasses came down to the same trick: make the WAF's HTTP parser and Next.js disagree about how to parse the request. Make the WAF see nothing, but let the backend parse the payload and run it. Read how we did it here: https://lnkd.in/gQsD4i2G

Not checkbox compliance. Not false promises. Not snake oil. Just real security.

No, it's not too good to be true. Get security zen with the same code reviewer that found critical zero-days in Next.js, OpenAM, and Metabase.

Your products won't get more secure with snake oil solutions that give you checkbox compliance and false positives. Maybe they can with Hacktron.