Dark Spear Platform Uses AI for Pentesting While Keeping Humans in Control

·1 views

Dark Spear is an AI-assisted penetration testing platform designed to automate security assessments without operating as a fully autonomous exploitation engine. The platform enforces scope boundaries, dangerous tool approvals, and evidence integrity through a trusted backend server rather than relying on client-side controls. It features three core components: a browser-based assessment engine, a backend enforcement bridge, and a SecOps reporting console for findings and remediation planning. Unlike traditional scanners, its AI agent can dynamically decide next steps during an engagement, but all actions are subject to server-side allowlisting and human approval gates. The architecture was built to treat security boundaries as engineering constraints rather than prompt-level instructions, ensuring findings remain verifiable and defensible.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why a Green CI Dashboard Can Hide a Broken or Empty Pipeline

A developer running an unattended pipeline for several months discovered two silent failures that never triggered error alerts. In the first case, a hardcoded month in a URL-verification script caused publish checks to return 404 from September onward, yet the job still exited with code 0, leaving the blog empty while the dashboard showed green for a week. In the second case, an image job completed 43 of 45 files before failing on a temp-directory cleanup due to a Windows file-handle issue, causing all output to be discarded because downstream logic relied solely on the exit code. The author argues that exit codes carry only one bit of information and cannot distinguish between a successful run and one that silently produced nothing. To catch such failures, the piece recommends validating artifacts by checking existence, size, file count, freshness, and whether files were actually modified during the current run, alongside adaptive baseline tracking that learns only from healthy builds.

0 comments Read more at DEV Community

ProgrammingHacker News ·

RonanRX (YC S26) Builds Vertically Integrated Pharmacy for Personalized GLP-1 Treatments

RonanRX, a Y Combinator S26 startup co-founded by Lloyd, is building a fully integrated pharmaceutical company covering telehealth, compounding, manufacturing, and drug delivery. The company focuses on GLP-1 medications and peptides, aiming to replace fragmented, manual pharmacy workflows with a software-driven, data-connected system. Patients who enroll share medical records, lab results, and wearable data, allowing doctors to continuously adjust personalized dosages based on real-time treatment responses. By owning the entire supply chain from molecule to doorstep, RonanRX claims its drugs are 3 to 10 times more affordable than traditional channels. The founder's own transformative experience with tirzepatide, including potential delay of a lifelong heart surgery, directly inspired the venture's focus on personalized GLP-1 therapy.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How Enterprises Are Automating Cloud Cost Controls to Cut Waste by Up to 20%

Cloud infrastructure teams at large enterprises face rapid cost accumulation from over-provisioned resources, unattached storage, and stale test environments that traditional spreadsheet audits cannot track in real time. A proactive FinOps approach embeds cost governance directly into CI/CD pipelines and cloud provisioning workflows, rather than reviewing spending after billing cycles close. Key measures include enforcing mandatory resource tagging via AWS Service Control Policies or Azure Policy, which block resource creation outright if cost-attribution metadata is missing. When sandbox accounts breach monthly budget thresholds, automated Lambda functions apply IAM permission boundaries that halt all new provisioning until waste is cleared. Additionally, static infrastructure-as-code tools like Infracost can flag costly pull requests during code review, with pipelines configured to fail if proposed changes exceed approved spending limits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SelfCmd Offers Offline Desktop App to Manage SSH, Schedules, and Server Monitoring

SelfCmd is a desktop application designed to consolidate server management tasks — including SSH connections, scheduled jobs, multi-step workflows, and resource monitoring — into a single offline tool. The app supports importing existing sessions from popular clients like PuTTY, MobaXterm, and SecureCRT, and stores credentials encrypted locally with no data sent externally. Users can build reusable command libraries with variable support, chain commands into repeatable workflows, and set resource alert thresholds without relying on cron syntax or external services. A built-in Model Context Protocol server allows AI tools such as Claude Desktop or Cursor to interact with saved commands and metrics without ever accessing user credentials. The app requires no account creation, collects no telemetry, and is designed to remain fully functional even if the developer's website goes offline.

0 comments Read more at DEV Community