VIPER: CyberSecurity Analyst

---

Inspiration

I started VIPER because security researchers have so much tools and spend too much time clearing out false positives, yet they still miss critical findings and spend too much time clearing out false positives.

As I came across projects like XBOW made me convinced that AI will play a major role in the future of cybersecurity. VIPER still doesn't have a LLM built into the pipelines yet, but that idea shaped my long term direction.

I want VIPER to feel like a cybersecurity analyst working beside you and be able to identify when the evidence isn't strong enough to call something a finding as recently multiple ethical hacking programs have closed submissions because of the sheer number of false positives ai produced findings (AI slop)

In early 2026 Escape Tech posted a blog where they scanned 5,600 "vibe-coded" applications and found 2,000 CRITICAL vulnerabilities. Which shows the market demand of my tool its Cheap, Fast, and Reliable Thus benefiting me by serving both sides of the market that includes newly made ai startups with low capital and enterprise applications looking for fast evaluations before deployment.

---

What it does

You point VIPER at a target you're allowed to test, and it works through it the way an analyst would, map the app, attack it, and only keep the findings it can actually prove.

1. Stays in bounds. Before it starts anything, VIPER makes an evaluation on the target to check if your actually allowed to test. If not, it immediately stops.
2. Learns the app. It walks the whole application, every page, input, and hidden corner, and builds a picture of how the pieces connect instead of just collecting a list of links.
3. Tries to break in. It safely runs the attacks a real hacker would, like logging in a victim token without the correct password, or slipping past a login check.
4. Proves what it finds. Nothing counts as a finding unless VIPER can prove it with evedince. Each one comes with the exact request that triggered it and a clear way to reproduce it to confirm the finding. Weak guesses get thrown out, not reported.
5. Hands you a clean report. You get the confirmed issues in a simple dashboard with understandable PoCs. The messy internal stuff such as passwords, raw traffic, logs, never leaves the engine.

A full scan on OWASP Juice Shop Takes approximately an hour (not the preview version) and produces findings with a PoC that would take a new pentester real effort to reproduce.

---

Architecture

VIPER scans as a staged pipeline. Meaning Each stage does one job and hands its results to the next. That Architecture prevents a broken or missing tool from stopping the scan, it degrades the next pipeline and send out a "stage failed error code".

Capability	Status	Notes
Recon + surface mapping	Live	subdomains, live hosts, URLs, params, JS
Vuln scanning	Live	SQLi, XSS, CVEs via nuclei / dalfox / sqlmap
Business-logic checks	Live	IDOR, race conditions, JWT
Evidence + PoC	Live	every finding tied to its exact request
Sanitized dashboard	Live	public view never sees raw scanner state
Live hosted demo	Live	running now at tryviper.me
LLM inside the pipeline	Planned	held to the same evidence bar as everything else

---

How we built it

VIPER have existed before Build Week. What I did during the event was push it much further, using Codex and GPT-5.6 as a real engineering partner.

I worked with Codex like a second engineer on the team. It helped me understand parts of the codebase that were beyond my skill set and it questioned assumptions I got wrong, found problems I hadnt noticed, and wrote tests to lock them down. Every change still had to earn its place, meaning it had to pass tests (Behavioral Tests, E2E UI Testing, And Integration Tests) Until I called it complete by the VIPER standard

The single biggest improvement from Build Week is that VIPER can now carry temporary information between steps in a workflow without that information ever leaking into a log or a report. It stays available only to the right user.

---

What's next for VIPER: Cybersecurity Analyst

I want VIPER to serve both ends of the market at once. Large companies needs depth and fast results. While AI startups needs cheap, and easy to reproduce findings. VIPER excels at both partially it runs a full scan on juiceshop in 1 hour, and produce findings PoC that are mildly hard for a new inexperienced penetration test.

My next steps is to make VIPER produce easier PoC, deepen its workflow understanding, and keep raising the bar on result quality before I raise the bar on feature count.

Feature improvements is to add Shodan Premium Integration, access controls, Chaos Project DB to massively sped up recon, Burp Suite Pro Integration, enterprise deployment, an d AI assistance that have control over VIPER while being as reliable as the rest of VIPER already does.

Winning would sped up the roadmap now instead of over years. Funding goes back into development, quality, and eventually model research, optimization, and fine-tuning.

I know this will take time. I believe VIPER can become something much bigger than it is today, and I'm willing to keep taking the risk and doing the work to get it there. That was my project story

---

Try Out Viper Now

tryviper.me
github.com/V1per0x7
VIPER on GitHub

Built With

Built With

• .