By David Speakman ·
An AI orchestrator runs real recon, scanning, exploitation, and post-exploitation tools against an approved scope. A companion app holds four human sign-off gates in the middle of that automation. Nothing ships without a person reviewing it first, not a scan, not a finding, not a report, not a gate.
The most severe risk is the combination of a world-readable environment file exposing the JWT_SECRET with the absence of role-based access control on protected API routes. Together these allow any network-connected attacker to forge a JWT of any role, advance engagement workflows, overwrite report content, and consume backend resources, all without legitimate credentials.Written by the orchestrator, from its own findings, during the validation run below.
Two pressures collide: a shortage of specialized security staff able to run manual assessments at release speed, and regulatory requirements that call for frequent, auditable validation instead of an annual PDF. Port scanning, CVE template matching, endpoint enumeration, and header audits are mechanical, well-specified work. Automation handles that part well. Deciding what's in scope, judging whether a finding is real, weighing how severe it actually is, and signing off on a client deliverable still need a human who can be held accountable for the call.
The platform is built around that split. It does not remove the human.
The companion app is the control surface that keeps Claude Code, the intelligence layer, from running an engagement by itself.
Reads the approved scope, resolves cloud provider constraints, dispatches workers, and analyzes every raw result itself, no external workflow engine in the loop. It polls the companion app for each gate but never approves one on its own.
A single-task agent dispatched per phase: recon, port scan, vuln scan, logic probe, exploit, post-exploit. It runs real tools over Bash, respects rate limits, stays off restricted subnets, and returns one structured JSON result.
FastAPI and React. Owns scope, the finding set, the report, and the audit trail. Every gate transition is a human clicking a button in this app, never an API call the skill makes on its own.
The completion routes for Gates 2 through 4 exist in the API, and the orchestrator is explicitly forbidden from calling them. Only a click inside the app advances the engagement.
Targets are classified as AWS, GCP, Azure, or on-premises before a single tool runs. The human sees the mapping and the banned categories, then approves.
Every phase's raw log is uploaded the moment that worker finishes, not batched at the end, and reviewed before analysis proceeds.
The finding set is editable in place: severity, CVSS, remediation. Manual findings from human testing get added here too.
The report is generated after Gate 3 closes, from whatever is in the app at that moment, so manual additions are never left out.
Every target is resolved against a locally cached CIDR database, no outbound lookups, before dispatch. Anything a provider's terms of service forbid is skipped and logged, not attempted and hoped for.
| Provider | Restricted | Auto-blocked | Ports/s | HTTP req/s |
|---|---|---|---|---|
| AWS | 169.254.169.254 | DoS, DNS flooding, control-plane bruteforce | 100 | 10 |
| Azure | 168.63.129.16 +1 | DoS, hypervisor exploitation, shared-compute scans | 150 | 15 |
| GCP | metadata.google.internal | DoS, spam campaigns, infra bruteforce | 100 | 10 |
| On-Premises | — | SOW exclusions only | Unlimited | Unlimited |
Every skip gets a reason, a target, and a provider, and lands in the report's Compliance Exclusions appendix.
The companion app doubles as its own validation target: a local build seeded with real, disclosed weaknesses, run through a full white-box engagement to confirm the platform finds what it's supposed to find.
/quit endpoint, unauthenticated Critical · 9.0Kill the test run with one curl.
Any authenticated user overwrites the report.
Forge any role, reach every engagement.
100% password reuse, cracked straight from the database.
Read and write every cached key.
Read hashes, bypass the state machine directly.
Full read and write, zero credentials.
The root cause behind FIND-003.
Overwrite the client deliverable with arbitrary text.
Unbilled compute use at the owner's expense.
Every discovered endpoint, tested against every credential role: auth enforcement, IDOR, RBAC escalation, business-logic bypass, injection, boundary values.
Each one traced to a specific confirmed finding: JWT algorithm-confusion forgery, direct database access, cache-protocol writes, live inference abuse.
Leaked signing secret, forged Lead-role token, every engagement and report writable. One chained narrative, not ten isolated bugs.
The first real run routed worker output through an external analysis workflow before it reached the report. The raw data was excellent. What came back was not.
Not a compiled binary, not a hosted service with a private ruleset. Two markdown files, one orchestrator and one worker, contain every rule this platform follows.
credentials.txt only. Everywhere else, reports, logs, checkpoints, they're masked.This is the pentest gate inside the SPEAKMAN.AI SDLC pipeline: the same set of Claude Code skills that architects, writes requirements, generates working code, and provisions infrastructure before anything reaches this gate.
Business description in, a draft Solution Architecture Document out, ready for human review before it goes in front of an ARB.
Domain model, naming dictionary, use cases, API and DB schema, test strategy.
A working, milestone-gated, git-committed codebase. A router picks the JavaScript, Go, or Python variant.
Terraform for whichever cloud you're targeting, GCP, AWS, or Azure, plus pre-pentest hardening applied straight to the codebase.
local → DEV. Code quality gate. Pass/block report, nothing fixed automatically.
DEV → STG. Security and reliability gate.
This platform, plus human-executed UAT. Both run against the live STG environment.
STG → PROD. Hardening gate, scored against pentest results and UAT pass rate.
Teams shipping continuously need a pentest before every promotion to production, not once a year, because the code under test changes weekly and the last assessment stops describing it the moment it does.
Security-conscious builders get a real toolchain, nmap, nuclei, nikto, gobuster, testssl.sh, searchsploit, run by an agent that documents what it couldn't check as carefully as what it found.
Compliance-driven organizations get an audit trail that can't be edited after the fact: a database trigger blocks UPDATE and DELETE on the log, backed by a parallel append-only file.
Physical separation, not row-level filtering. A finding from one engagement structurally cannot surface in another.
No cloud dependency for the companion app itself, though Claude Code may call its own model API elsewhere. The app never does.
Or run natively: Debian/Ubuntu, Fedora/Arch, macOS via Homebrew, and Windows through WSL2 are all documented paths.
The companion app and both skills are public. Clone it, read the markdown, run it locally, and point it at a scope you're authorized to test.
Written by David Speakman. Speakman Consulting designs and builds this kind of system for growing organizations: agent workflows with the governance that keeps humans in the loop.