Brave Pentest Toolkit
An ambient, one-click pentesting toolkit built into the browser — a Brave/Chrome extension with a 31-tool catalog, live passive security scoring on every page, and a native-messaging host bridging to his own CLI security toolkit.
31
Tools in the catalog
2
Real bugs caught by testing
- 31-tool catalog across recon, web vulnerability, directory discovery, and network testing
- Passive A-F security score badge on every page, computed from real response headers
- Scope-gate enforcement lives in the native host, not the extension — verified adversarially, survives a full process restart
- Toolbar icon renders procedurally via OffscreenCanvas instead of shipping a static asset for every state combination
- Two real bugs caught by actually clicking through a live test harness, not just reading the code
Problem
Ambient, one-click pentesting needs to live in the browser without new tabs or lost scan state — and trust has to be enforceable, not just described in the UI.
Approach
The toolbar popup is front and center with live scan progress, backed by a side panel for scans worth keeping visible while working the page — both share one UI module kept in sync through storage events. Trust runs through a native-messaging host: a random token plus an ephemeral loopback WebSocket bootstrap the connection, and scope enforcement checks against a file on disk the extension can't override.
Outcome
A 31-tool catalog, a passive A-F security score computed from real response headers, and two real bugs — a scanner timeout race and a silently-broken disabled state — caught by actually clicking through a live test harness, not just reading the code.
Next
The Reaper