ExploitSpec is a free, local-first CLI and GitHub Action for preserving a confirmed HTTP exploit as a deterministic regression test. Define isolated actors, capture dynamic values, assert the security boundary, and calibrate the same invariant RED on the vulnerable baseline, GREEN after the fix, and STABLE across repeated runs. Plain YAML, Apache-2.0, no account, no telemetry, and no hosted service.
Framer AI AgentsDesign and publish professional sites with AI
Promoted
Maker
📌
I built ExploitSpec because a pentest report proves a bug at one moment, but it rarely becomes a test that guards the exact boundary afterwards.
The project intentionally does not scan or invent findings. It starts after a human has proven the exploit, then makes the actors, captures, and invariant reviewable and repeatable in ordinary CI.
The repository contains a one-command local demo, a minimal consumer template, and a public BOLA/IDOR case study backed by a green CI run. I would value concrete criticism about cases that should not be represented this way.
Case study: https://github.com/pazent/exploi...
Disclosure: I am the creator and maintainer. Everything is Apache-2.0 and there is no paid edition.