ExploitSpec is a free, local-first CLI and GitHub Action that turns a confirmed HTTP security finding into a deterministic regression test. Define isolated actors, capture dynamic values, assert the security boundary, and calibrate RED → GREEN → STABLE. v0.2 adds bounded, conservatively redacted HAR import without replaying traffic. Plain YAML, Apache-2.0, Homebrew, no account, telemetry, or hosted service. It is not a scanner: you supply the proven finding.

I built ExploitSpec because a pentest report proves a bug at one moment, but it rarely becomes a test that guards the exact boundary afterwards. The project intentionally does not scan or invent findings. It starts after a human has proven the exploit, then makes the actors, captures, and invariant reviewable and repeatable in ordinary CI. The repository contains a one-command local demo, a minimal consumer template, and a public BOLA/IDOR case study backed by a green CI run. I would value concrete criticism about cases that should not be represented this way. Case study: https://github.com/pazent/exploi... Disclosure: I am the creator and maintainer. Everything is Apache-2.0 and there is no paid edition.

ExploitSpec

Turn proven HTTP exploits into permanent regression tests

Turn proven HTTP exploits into permanent regression tests