This product was not featured by Product Hunt yet. It will not be visible on their landing page and won't be ranked (cannot win product of the day regardless of upvotes).
Penthera
Penthera: free elite cyber security agent for your site/app
Find security gaps before you push to production. Point Penthera (local btw) at your site or code and see what's wrong, with evidence. It checks secrets, headers, dependencies and your AI setup (MCP, skills, plugins). It fixes what it can with your consent on a local branch, then re-scans to prove it. Free and open source. Research-backed rules decide every finding, your code stays on your machine, no account, no telemetry. Benchmarked in public, no bs, just more safety for all.
As we've seen last month(s) with PHP, hacks, EU gov shutting down, and other CVEs - cybersecurity is going wild (finally). How can we make our systems safer as AI gets smarter? While I don't have a direct answer, I know that -as a computer scientist- there are things you can do within your control, like fixing your security principles and think like a hacker before you launch. You don't need to get an expensive degree or 50 years of experience to do that tho. Hence, i open-sourced my security rules I've collected over the years- wrapped up in a pretty package/agent/skill (whatever they will call it in a year from now)
I started Penthera as a local pentester for my own projects (made 100+ apps for 1M+ users that generated big $, but like no one (except Binance) could afford getting hacked) because AI lets people ship an app in a weekend, and nothing/nobody (unless you are a cyber hacker) tells you what you just left insecure. Good security tooling was either expensive or built for people who already know what a CSP is (do you?).
I think security is/should be a right for every builder, not a paid luxury, wishy-washy companies, or asking your AI agent "yo fix my code" (aka your codebase leaving your computer = high risk). So Penthera is free, rule-based ("non-AI", but we have a flag if you'd like a second look from your own local LLM; it can only propose, and the rules check it; in short, an agentic harness) and open source. Point it at your site or your code, see what's wrong in plain words, and it fixes what it can with your consent. It checks your AI setup (MCP, plugins, skills, hooks) too.
Research-backed rules decide every finding, not a model. Your code stays on your machine, with no account and no telemetry (so nothing going to our servers). And I benchmarked it in public against 25 free tools, losses included: tied 1st on npm and PyPI malware, but 2nd on leaked secrets, not 1st. Also just finished measuring ~7,000 sites/apps with Penthera (biggest study I've done); results coming soon
Happy to answer anything about the rules, the benchmarks, or the app you're about to ship. Try it on your next launch and lmk what it missed or make a PR!
<3 to happy safe coding and building your ideas into reality (without getting hacked and crazy creditcard bills for tokens you've never used)
it checks your code, packages, AI setup (MCP, skills, plugins) and your live site, and tells you what's wrong in plain words. needs Node 22+, no account, nothing leaves your machine
2. let it fix what it can: it shows each change, asks for your consent, applies it on a local branch, then re-checks to confirm the fix. what it can't fix, it tells you
3. keep it running where you already work:
- in your coding agent (Claude Code, Cursor, Codex): npx skills add danoszz/penthera
- as an MCP server: claude mcp add penthera -- npx -y penthera@2.2.0 mcp
- on every push, with the GitHub Action
just want a quick look first? paste your URL at penthera.org, passive check, nothing stored then you get to make the hard decision: what to build next, now that you know what's open
try it on your next launch and tell me what/if it got (something) wrong, leave a star to receive updates and if you feel adventerous feel free to make a PR to improve
About Penthera on Product Hunt
“Penthera: free elite cyber security agent for your site/app”
Penthera was submitted on Product Hunt and earned 5 upvotes and 4 comments, placing #35 on the daily leaderboard. Find security gaps before you push to production. Point Penthera (local btw) at your site or code and see what's wrong, with evidence. It checks secrets, headers, dependencies and your AI setup (MCP, skills, plugins). It fixes what it can with your consent on a local branch, then re-scans to prove it. Free and open source. Research-backed rules decide every finding, your code stays on your machine, no account, no telemetry. Benchmarked in public, no bs, just more safety for all.
Penthera was featured in Artificial Intelligence (482.9k followers), GitHub (41.5k followers), Security (3k followers) and Vibe coding (744 followers) on Product Hunt. Together, these topics include over 177.1k products, making this a competitive space to launch in.
Who hunted Penthera?
Penthera was hunted by Daan van der Zwaag. A “hunter” on Product Hunt is the community member who submits a product to the platform — uploading the images, the link, and tagging the makers behind it. Hunters typically write the first comment explaining why a product is worth attention, and their followers are notified the moment they post. Around 79% of featured launches on Product Hunt are self-hunted by their makers, but a well-known hunter still acts as a signal of quality to the rest of the community. See the full all-time top hunters leaderboard to discover who is shaping the Product Hunt ecosystem.
Want to see how Penthera stacked up against nearby launches in real time? Check out the live launch dashboard for upvote speed charts, proximity comparisons, and more analytics.
Daan van der Zwaag
As we've seen last month(s) with PHP, hacks, EU gov shutting down, and other CVEs - cybersecurity is going wild (finally). How can we make our systems safer as AI gets smarter? While I don't have a direct answer, I know that -as a computer scientist- there are things you can do within your control, like fixing your security principles and think like a hacker before you launch. You don't need to get an expensive degree or 50 years of experience to do that tho. Hence, i open-sourced my security rules I've collected over the years- wrapped up in a pretty package/agent/skill (whatever they will call it in a year from now)
I started Penthera as a local pentester for my own projects (made 100+ apps for 1M+ users that generated big $, but like no one (except Binance) could afford getting hacked) because AI lets people ship an app in a weekend, and nothing/nobody (unless you are a cyber hacker) tells you what you just left insecure. Good security tooling was either expensive or built for people who already know what a CSP is (do you?).
I think security is/should be a right for every builder, not a paid luxury, wishy-washy companies, or asking your AI agent "yo fix my code" (aka your codebase leaving your computer = high risk). So Penthera is free, rule-based ("non-AI", but we have a flag if you'd like a second look from your own local LLM; it can only propose, and the rules check it; in short, an agentic harness) and open source. Point it at your site or your code, see what's wrong in plain words, and it fixes what it can with your consent. It checks your AI setup (MCP, plugins, skills, hooks) too.
Research-backed rules decide every finding, not a model. Your code stays on your machine, with no account and no telemetry (so nothing going to our servers). And I benchmarked it in public against 25 free tools, losses included: tied 1st on npm and PyPI malware, but 2nd on leaked secrets, not 1st. Also just finished measuring ~7,000 sites/apps with Penthera (biggest study I've done); results coming soon
Happy to answer anything about the rules, the benchmarks, or the app you're about to ship. Try it on your next launch and lmk what it missed or make a PR!
<3 to happy safe coding and building your ideas into reality (without getting hacked and crazy creditcard bills for tokens you've never used)
Daan