# 0sec

> Applied security research lab shipping pwnkit and the 0sec managed cloud surface.

0sec is the company site for the applied security research lab behind pwnkit. pwnkit uses AI agents in a research-then-verify pipeline to find and prove vulnerabilities. It scans AI/LLM apps, web apps, npm packages, and source code.

## Quick Start

```bash
# pwnkit is closed-source. For access, contact security@0sec.ai.
docker run --rm ghcr.io/0sec-labs/pwnkit:latest scan --target https://your-app.com/api/chat
docker run --rm ghcr.io/0sec-labs/pwnkit:latest scan --target https://example.com --mode web
```

## Key Features

- **Autonomous multi-agent pipeline**: Research agent discovers and attacks, then a blind verify agent independently reproduces findings
- **Verification eliminates false positives**: The Verify agent re-exploits every finding independently. If it can't reproduce it, the finding is dropped
- **4 attack surfaces**: AI/LLM apps, web apps, npm packages, source code
- **CLI commands**: scan, audit, review, resume, replay, history, findings, dashboard, orchestrate, doctor
- **Local dashboard**: Web-based verification workbench for triage, evidence review, scan provenance, and finding workflow management
- **Resumable scans**: Persist and resume interrupted audit and review scans
- **Finding families**: Deduplicate findings across scans, triage once for all instances
- **Multi-runtime**: Works with Claude Code, Codex, Gemini CLI, auto-detect, or API-only mode (Anthropic, OpenRouter, OpenAI, Azure OpenAI)
- **SARIF output**: Findings appear directly in GitHub's Security tab
- **GitHub Action**: Drop into CI/CD with `0sec-labs/pwnkit@main`
- **Zero config**: auto-detects target type, no YAML, no setup
- **Diff-aware review**: `--diff-base main --changed-only` to review only changed files in PRs

## Product Model

- **pwnkit-cli** is the execution surface. Run scans, audits, reviews from terminal or CI. Resume interrupted scans. Export SARIF, JSON, Markdown, or HTML.
- **pwnkit-cli dashboard** is the operator surface. Local web UI for finding triage, evidence review, scan provenance, and human sign-off.

## Built From Real Research

pwnkit was built from the methodology that found 7 CVEs in npm packages with 40M+ weekly downloads, including node-forge (32M/week), mysql2 (5M/week), Uptime Kuma (86K stars), LiquidJS, jsPDF, and picomatch.

## Links

- Website: https://0sec.ai
- pwnkit Docs: https://docs.0sec.ai
- GitHub: archived (private, closed-source)
- Author: https://doruk.ch
- CVE writeups: https://doruk.ch/blog