Hey Product Hunt! I'm the maker of Vulinder. Every week there's another breach in the news, and attackers are now using AI to automate recon and exploitation. But most dev teams I know don't have a security engineer, and a yearly pentest is expensive and out of date by the next deploy. So I built Vulinder: an AI that pentests your own services the way an attacker would, whenever you want. What makes it different Instead of running a fixed checklist, the AI reads each response and decides what to try next. - Web apps: SQLi, XSS, SSRF, IDOR and more, including pages behind login - Servers: exposed services, SSH and TLS configuration - LLMs: prompt injection, jailbreaks and data leakage across multi-turn conversations Every finding includes the actual request and response, so you can see the proof yourself instead of wondering if it's a false positive. It also covers the basics in one place: SAST, SCA, SBOM, DAST and IaC scanning, with remediation tracking and reports. "Can I trust you with my code and credentials?" Fair question. Here's how we handle it: - Credentials are encrypted at rest (AES-256-GCM) - Source code is deleted after analysis - Pentest login credentials never touch the database or logs - Web scans only run on domains you've verified you own There's a free plan, so you can point it at a side project in a few minutes. I'd love to hear from you: - What would you want an AI pentester to check first? - Did anything look like a false positive? Thanks for checking it out!

Vulinder

AI pentesting for your web apps, servers, and LLMs

AI pentesting for your web apps, servers, and LLMs