Valtik Studios
Open Source

The tools we built because nobody else did.

We publish open-source CLI tools that fill real gaps in the security-tooling ecosystem. No wrappers around nmap, no clones of nuclei, no reskinned subdomain enumerators. Each tool targets something a working pentester cannot solve today without writing the code themselves.

github.com/TreRBNeed a full audit?

What we open source, what we don't

Open source
  • Detection tooling for misconfigurations that public-disclosure has already documented
  • First-mover tooling for new ecosystems where nothing mature exists
  • Utility libraries that encode our research patterns
  • Every tool is MIT-licensed, CI-tested, self-contained
Paid service
  • Active exploitation + attack chain construction
  • Written reports with executive summary + remediation roadmap
  • Reproducible proof-of-concept against your environment
  • 30-day to 90-day retest windows + auditor-ready documentation
AI Security / Exfil

markdown-exfil-tester

LIVE

Black-box test whether an LLM chatbot is vulnerable to markdown/HTML exfil (the Copilot CVE-2025-32711 / Feb 2026 ChatGPT / ForcedLeak class). Spins up a local sink, sends 36 exfil payloads, renders each LLM response in headless Chromium, correlates via network to confirm real exfil vs CSP-blocked.

Why this exists

Garak, Augustus, and Promptfoo test text-layer injection but never answer 'did the frontend actually fetch the attacker URL?' Lakera + Protect AI have this behind paywall. 36 payloads, 27 tests, E2E verified.

$ npx github:TreRB/markdown-exfil-tester <chatbot-url>
View Repo
AI Security (Python)

rag-poison-detector

LIVE

Read-only vector DB poison detector. Connect to Pinecone / Weaviate / Chroma / Qdrant / pgvector, scan for embedding outliers, prompt-injection patterns in chunks, invisible Unicode smuggling, and AgentPoison-style backdoor triggers. Live-tested against chromadb with planted poison: all 6 check classes surfaced at expected severities.

Why this exists

OWASP LLM Top 10 2025 added 'Vector and Embedding Weaknesses'. AgentPoison paper showed >80% attack success. Existing OSS is PoC-only (prompt-security/RAG_Poisoning_POC) or attack-only (AI-secure/AgentPoison). Valtik's first Python tool. 25 tests.

$ pipx install git+https://github.com/TreRB/rag-poison-detector
View Repo
CI/CD Supply Chain (Go)

gh-actions-pwn-hunter

LIVE

Static scanner for GitHub Actions workflows targeting the pwn-request RCE class that hit Microsoft, DataDog, CNCF, and hundreds of OSS projects Feb-April 2026. 8 checks, embedded compromised-SHA feed (tj-actions March 2025, Ultralytics Dec 2024). First run on our own repos caught PW4 (default permissions) + PW5 (secret interpolation). We fixed ours before shipping.

Why this exists

nikitastupin/pwnhub is a PoC. Step Security Harden-Runner is SaaS. rapidfort/gh-action-security-audit only does 3 checks. zizmor misses compromised-hash intel. This combines live compromised-SHA feed + org-wide scanner + SARIF + zero-false-positive safe-fixture invariant.

$ go install github.com/TreRB/gh-actions-pwn-hunter@latest
View Repo
AI IDE Security

ai-ide-config-guard

LIVE

Scan a repo for AI-IDE configuration that triggers RCE: Claude Code SessionStart hooks, Cursor/Windsurf rules-file Unicode smuggling, MCP auto-registration, ANTHROPIC_BASE_URL redirect, VS Code folderOpen tasks. Addresses CVE-2025-59536, CVE-2026-21852, CVE-2026-30615, and Pillar Rules File Backdoor.

Why this exists

Snyk agent-scan + Cisco skill-scanner target MCP servers. Nobody scans the repo-side IDE trust boundary. Mend has this behind paywall. 8 checks, 57 tests, SARIF output for GitHub code scanning.

$ npx github:TreRB/ai-ide-config-guard <path>
View Repo
AI Gateway (Go)

ai-gateway-audit

LIVE

Audit AI gateway deployments (LiteLLM, OpenRouter, Portkey, Vercel AI Gateway) for master-key exposure, virtual-key cross-tenant leak, missing per-key budgets, provider fallback cost-DoS, PII masker bypass, rate-limit bypass via X-Forwarded-For rotation, and known-vulnerable LiteLLM versions.

Why this exists

LiteLLM has 17k stars + CVEs. Every ChatGPT-Enterprise replacement in 2026 runs on a gateway. No OSS scanner exists. Valtik's first Go tool — single 7.7MB static binary.

$ go install github.com/TreRB/ai-gateway-audit@latest
View Repo
AI Security

ai-endpoint-discovery

LIVE

Find AI/LLM endpoints on a target domain. Static-fingerprints 18 AI SDKs in JS bundles, extracts gateway base URLs, probes common endpoint paths with one benign completion to classify auth posture. Smoke test on vercel.com picked up Vercel AI SDK + OpenAI + Replicate + 8 hinted paths.

Why this exists

Garak tests LLM safety if you have the endpoint. Nobody discovers AI endpoints as an attack surface. Shadow-AI recon tool for the 2026 era of undisclosed LLM features.

$ npx github:TreRB/ai-endpoint-discovery <url>
View Repo
Identity

oidc-discovery-audit

LIVE

Audit OIDC / OAuth 2.0 authorization-server metadata for weak algorithms, PKCE downgrade, algorithm confusion (RSA + HMAC mix), SSRF via request_uri, JWKS quality, and issuer-mismatch attacks. First run on accounts.google.com caught a real PKCE 'plain' method advertisement. Microsoft's multi-tenant issuer placeholder ({tenantid}) flagged too.

Why this exists

jwt_tool works on tokens, not IdP metadata. Doyensec + PortSwigger write about these attack patterns; nobody ships the scanner. 11 check IDs, 63 tests, live tested against Google, Microsoft, GitHub Actions OIDC, Auth0.

$ npx github:TreRB/oidc-discovery-audit <issuer>
View Repo
BaaS / Tenant Isolation

rls-tester

LIVE

Black-box test that Row-Level Security actually enforces tenant isolation on Supabase / PostgREST / Hasura / PocketBase. Give it two tenant JWTs, it probes every table and flags where tenant A can read tenant B's rows.

Why this exists

Ship-Safe is static analysis on your own repo. Nothing black-box tests tenant isolation from the outside. This is the primitive pentesters rebuild every BaaS engagement. 43 tests, 4 backends, read-only default + opt-in write probes.

$ npx github:TreRB/rls-tester <url>
View Repo
Web / Supply Chain

source-map-sentinel

LIVE

Detect exposed source maps on production websites, reconstruct the original TypeScript sources, and grep for leaked Stripe keys, internal API routes, unreleased feature flags, and design-intent TODO comments. Built after the March 2026 Claude Code source-map leak (59.8MB to prod, 16-21M views).

Why this exists

Sentry sourcemap-unmapper is paid + hosted. No CLI reconstructs + greps in one shot. 21 secret patterns including Stripe live/test/restricted, AWS, Anthropic, OpenAI, Supabase service_role JWT validation.

$ npx github:TreRB/source-map-sentinel <url>
View Repo
Recon / Compliance

well-known-audit

LIVE

Enumerate every /.well-known/ resource on a domain and score it for compliance + oversharing. First run on github.com found they're leaking an internal-dev Android package name via assetlinks.json.

Why this exists

22 resources in the IANA registry, 40+ variants in the wild. Nobody had a unified auditor. securitytxt.org validates one endpoint. Optional OIDC chain for auth server deep-dives.

$ npx github:TreRB/well-known-audit <domain>
View Repo
Cloud / Platform

vercel-env-audit

LIVE

Enumerate every environment variable across a Vercel team and flag which aren't marked Sensitive. Built in response to the April 2026 Vercel security incident.

Why this exists

Vercel UI shows Sensitive flag per-project, not at team level. No existing tool for team-wide posture review.

$ npx github:TreRB/vercel-env-audit
View Repo
Application Security

baas-audit

LIVE

Detect Supabase, Convex, Clerk, Firebase, Auth0, Appwrite, Hasura, and PocketBase on a live website. Flag the platform-specific misconfigurations each one is prone to. Read-only, no exploit traffic.

Why this exists

No unified detection tool. Pentesters build this for every engagement. Open-sourcing the detection + known-misconfig database. 32 tests, 8 detectors, zero exploit code.

$ npx github:TreRB/baas-audit <url>
View Repo
AI Security

mcp-security-scanner

LIVE

Static audit of an MCP (Model Context Protocol) server for the five attack patterns from our blog post: tool arg validation, shell passthrough, FS scope, SSRF via fetch, credential exposure. Found a genuine schema gap in Anthropic's own reference server on first run.

Why this exists

MCP is 6 months old. Zero mature audit tooling exists. First-mover in a fast-growing ecosystem. Covers TypeScript + JavaScript + Python MCP servers.

$ npx github:TreRB/mcp-security-scanner <path>
View Repo
SaaS Security

salesforce-guest-audit

COMING SOON

Enumerate what Salesforce Experience Cloud guest users can see. Reproduces the read-only half of the ShinyHunters attack pattern that hit McGraw-Hill, AT&T, Ticketmaster, Santander.

Why this exists

Salesforce admins cannot test this easily today. Existing tools require licensed Event Monitoring. This is detection-only, no exploitation.

Repo pending
Identity

oauth-grant-audit

COMING SOON

Given a Google Workspace / GitHub / Slack / Vercel admin token, enumerate every OAuth grant (installed apps, third-party integrations) with a scope-breadth risk score.

Why this exists

Workspace admin UI is terrible for this. Post-Vercel incident, every team needs this visibility.

Repo pending

Got a tool idea?

We're always looking for gaps in the tooling ecosystem we can fill. If you run into a security problem you cannot solve today with existing public tools, tell us. We might open source the answer.

Tell us about it