OpenHack, Your AI Security Engineer
OpenHack finds and fixes vulnerabilities in your code, runs AI pentests, and prioritizes findings using real exploitability and business context like a real security engineer.
Trusted by engineering teams
OpenHack Platform
A full security suite that works together
AI Pentesting
Autonomous end-to-end pentests against your live infrastructure and applications.
Read morePerfect for startups, enterprises & security researchers.
Run the open source CLI yourself, or let the platform run it across every repo.
OpenHack TUI
Point it at any codebase or target and run it from your terminal. Connect any model from any provider, including open source ones you host yourself.
- Any model from any provider, including ones you host yourself
- Runs locally, straight from your terminal
- Every finding verified with a working exploit
- Free forever, and fully open source
OpenHack Platform
Scanning across every repo in the org, findings triaged by real business impact, and fixes opened as pull requests your team can merge.
- Managed scanning across every repo in the org
- Fixes opened as pull requests, ready to merge
- SSO, audit logs, and team controls
- Findings ranked by business impact, not raw CVSS
FAQ
What is OpenHack?
OpenHack is your AI security engineer. It finds, verifies, prioritizes, and fixes vulnerabilities across your codebases and live applications.
What does OpenHack do?
OpenHack scans code, runs autonomous pentests, validates findings with working exploits, prioritizes them using real business impact, and prepares fix pull requests. It works across application code, authentication flows, APIs, dependencies, secrets, and business logic.
How does OpenHack verify vulnerabilities?
OpenHack validates findings by building a working proof of concept and reproducing the issue in a sandbox or browser before it reports the vulnerability.
What kinds of vulnerabilities can OpenHack find?
Beyond basic vulnerabilities, OpenHack finds business logic flaws, race conditions, timing attacks, IDORs, authentication bypasses, exposed secrets, and vulnerable dependencies. More importantly, it reasons across findings and intelligently chains vulnerabilities to demonstrate attack paths that isolated checks miss, like a real security engineer.
What AI models can I use?
You can use any AI model you want in the CLI and connect any provider. The platform uses OpenHack's managed zero data retention inference.
What is the difference between the open-source CLI and the platform?
The open-source CLI runs locally and gives you direct control over scans and models. The managed platform adds continuous scanning across repositories, team controls, business-aware prioritization, and fix pull requests.
Where is my data stored?
Your code, scan data, and findings are stored locally. Only requests needed for inference leave your environment, and all inference is processed within your local geographic region or data domicile.