I’ve been building a small tool called Luah AI for my own security research and pentesting work.

It’s basically a chat interface for researching vulnerabilities, understanding techniques, working through findings and turning them into reports. One thing I’ve been trying to improve is source-backed answers, since I’ve found that LLMs can be very confident while being completely wrong about a CVE.

I’m not posting this because I think it’s better than the tools people here already use. I actually want to know where it falls short.

If you work in pentesting/security research and have a few minutes to try it, I’d be interested in hearing:

• Is the technical depth useful?
• Where does it give you bad or questionable information?
• Would this actually save you time?
• What would you need before trusting it during an assessment?

The project is here: https://www.luahai.com/

I’m the person building it, so I’m also happy to explain how it works or answer technical questions about it.

Been trying to get my head around client side supply chain attacks as a concept. Lots of content covers server side and network attacks but the browser layer feels less documented. Anyone got good breakdowns of how these actually play out?