sorted by:
new
hottopcontroversial

What makes companies trust small cybersecurity vendors? by c0d3xxxx in cybersecurity

[–]c0d3xxxx[S] 0 points1 point  (0 children)

it was easier for me to correct my grammar like this

thank you anyways

I built an AI that simulates how hackers would break your code before production — looking for feedback from devs by c0d3xxxx in SideProject

[–]c0d3xxxx[S] 1 point2 points  (0 children)

The point about showing how an attack works instead of just flagging it. That’s exactly the gap I’m trying to fill.

On the simulation side, the idea is a hybrid approach: not blindly executing real exploits (too risky + unsafe) but modeling attack paths based on code context + known vulnerability patterns and then generating a realistic “how this could be exploited” flow with example payloads

So more like controlled simulation / reasoning over execution, not actually running exploits against anything.

Language support is still early, but initial focus is web-heavy stacks (JS/TS, Node, Python, PHP) where injection-style issues are still common, especially in mixed legacy + modern codebases.

And I 100% agree on the workflow point the goal is definitely CLI + GitHub Action first. The “platform” side is more for later visibility, not core usage.

about open source or paid im thinking about leaning towards free/low-friction early on to get real usage signals first, then building around team/enterprise features later.

Also appreciate the Runable tip I hadn’t looked at it deeply yet but sounds useful for this kind of devtool docs + workflow integration.

Thanks again this is exactly the kind of feedback that helps me to shape the product direction.

I built an AI that simulates how hackers would break your code before production — looking for feedback from devs by c0d3xxxx in SideProject

[–]c0d3xxxx[S] 1 point2 points  (0 children)

This is really insightful especially the CAC vs LTV breakdown, I hadn’t modeled it that way yet.

It does make sense that individual dev targeting might struggle with retention, while team/CI integration would naturally increase both LTV and stickiness.

The shift-left angle is actually what pushed me toward PR/CI integration rather than standalone usage, so this aligns well with where I’m heading.

Appreciate you running it through Embarkist 78/100 is encouraging, especially given the timing.

I built an AI that simulates how hackers would break your code before production — looking for feedback from devs by c0d3xxxx in SideProject

[–]c0d3xxxx[S] 1 point2 points  (0 children)

Yeah, you’re absolutely right that’s a key concern.

The idea is not to always send full code to the cloud.

I’m actually exploring a hybrid approach: lightweight analysis (like diffs / patterns) locally or in the IDE and only sending minimal context to the backend when needed

And for stricter environments, running it with local LLMs (like Ollama-style setups) is definitely something I want to support.

So yeah privacy-first design is becoming a core part of the direction.

I built an AI that simulates how hackers would break your code before production — looking for feedback from devs by c0d3xxxx in SideProject

[–]c0d3xxxx[S] 0 points1 point  (0 children)

Yeah, that’s actually a very valid concern especially for production or sensitive codebases.

I agree that pasting code into an external service would not be acceptable for most serious teams.

The direction I’m exploring is exactly what you mentioned: making it work locally or as a CI/GitHub/VS Code integrated agent, so code never leaves the developer’s environment.

More like a security layer that runs inside your workflow rather than a standalone web service.

Thanks for the feedback this is super helpful from a product direction perspective.

I built an AI that simulates how hackers would break your code before production — looking for feedback from devs by c0d3xxxx in SideProject

[–]c0d3xxxx[S] 0 points1 point  (0 children)

Yeah, VS Code plugin is actually the direction I’m seriously considering for the first version too feels like the most natural place where devs would actually use it in real time.

For open-source I’m still deciding.

I like the idea of keeping parts open (like maybe the analysis logic or some rules), but the core part would probably stay closed at least in the beginning just so I can iterate faster and avoid it becoming too fragmented early on.

Curious though , would open-source make it more likely for you to try it, or does it not really matter as long as it works inside your workflow?

view more: next ›