The auto.hacker manifesto

Automated security scanners are useful and dangerous for the same reason: they send traffic at a target without asking. We built auto.hacker on one rule that makes the danger go away.

One rule

No scan runs against a host until the person asking has proven they control that exact host — and the proof is re-checked the moment the scan launches, and again right before the first request. A target you cannot prove you own is refused. There is no override, no allow-list, no "just this once".

How you prove it

Pick one, per host. We give you a token that is unique to your account and that host:

• DNS TXT — _autohacker.<host> set to autohacker-verify=<token>.
• File — https://<host>/.well-known/autohacker-<token>.txt containing the token.
• Meta tag — <meta name="autohacker-verify" content="<token>"> on the homepage.

What we do, and don't

The checks are non-destructive: GET requests and one-shot probes with short timeouts, no payload delivery, no exploitation. We keep an immutable authorization log of every verification. We rate-limit scans per host. We never accept a raw URL into the engine without the ownership check in the same code path.

This is not a manual penetration test and does not pretend to be. It is a fast, repeatable, authorized first pass you can run on your own sites as often as you like.

Surfaces: web, JSON API, autohacker CLI, MCP server and a TUI. Engine: ThreatCrush. A Moshpit name on the pit.world network.