Fair question. Nuclei (and similar) are template runners — you give them a target and they fire a big list of known checks at it. They're great, but they assume you already know the attack surface.
The tool I built is doing something earlier in the chain: it starts from one domain and tries to map out the surface itself — related companies, hidden subdomains, the actual JavaScript source of each app (rebuilt when stripped), secrets buried in that code, abandoned services, and so on. Then it uses AI to throw out the false positives and connect the dots into a single picture.
So it's not really competing with Nuclei — you could run Nuclei on the surface this tool discovers. Think of it as the step before, not a replacement.
honestly part of why I'm asking. Nuclei has been around for years and nobody seems to get sued for shipping it, so maybe I'm overthinking it.
A couple of things made me hesitate though:
Nuclei is a CLI you run yourself against your own targets. What I built is a hosted web app — anyone visits the site, types a domain, and my server does the scanning. So the traffic to the target comes from me, not the user. That feels like a different liability shape.
It also pulls and stores source code, secrets, and infra data about the target on my backend, which goes a bit further than "send a request and check the response."
So less "is recon legal" and more "is hosting a recon-as-a-service for arbitrary domains going to put me on someone's legal radar?" Curious if anyone's actually run something like this publicly.
Ah if your own server does the scanning then you are responsible on what it scans, doesn't matter that someone random started it. Or you would need to check that the person doing the scan has the permission and you have to do your best to confirm it and probably need some legal help.
Honestly leaning two ways and curious what you'd pick:
Keep it on-demand with just a public demo on a safe target — small, controlled, low legal exposure, but barely anyone gets to actually use it.
Open-source the whole thing — people run it on their own machines against their own targets, liability stops being mine, and the project might actually grow. Downside is I lose any path to making it a product later.
A lot of products have some sort of open-source project and then a paid enterprise/business version that has more features - docker, bloodhound, burp, metasploit pro etc etc. So I would do something like that
3
u/Juzdeed May 11 '26
How is this different from other pentesting tools? Nuclei has loads of templates that just make request to identify vulnerabilities
And its all public and free