Authorized attack-surface
scanning — with ownership gates.

Overview

Hackly is an orchestration layer for authorized attack-surface and application security scanning. You inventory targets, prove ownership, scan GitHub repositories via PAT, run soft rate-limited jobs, and review normalized findings in Filament.

Target (DNS-verified)               Repository (GitHub PAT)
   │                                      │
   ├─ link, from either side or a pentest ┤
   │                                      │
   ├─ Scan (DAST)                         ├─ RepoScan
   │    uses routes from the last clone   │    remembers those routes
   ├─ Penetration test                    │
   │    standing DNS + deep linked scan   │
   └─ Compliance subject                  └─ same line when the two are linked

Jobs use the database queue (no Horizon). A queue worker must be running for scans to execute. Linking is optional — each side can still be scanned on its own. When you do link them, DAST, penetration tests and compliance use the pair.

Compared with other tools

Hackly is a self-hosted orchestrator for the domains and GitHub repositories a Laravel team already operates. Aikido, Detectify, Snyk, Semgrep, GitHub Advanced Security and DefectDojo overlap with it and then diverge. This is a fit comparison, written from Hackly's side. It is not a scan-off. The commercial products move faster than this page.

Aikido

Aikido is a commercial application-security platform. One product covers SAST across major languages, dependency scanning with reachability, secrets, malware and license risk in open source, infrastructure as code, containers, cloud posture, dynamic testing including authenticated DAST, API discovery and fuzzing, attack-surface monitoring, AI pentesting, autofix pull requests, and runtime protection. There is a free tier. Local scanning and a full on-prem deployment exist on paid and government plans. The default is hosted: Aikido clones repositories into short-lived environments, scans them, and throws the clone away.

On the things that make a security platform, Aikido is ahead. It covers languages a PHP ruleset and a set of Laravel checks do not. It opens a pull request with a proposed fix. Hackly can copy a finding as a prompt, and the repository stays as it was. Aikido looks at cloud accounts, Kubernetes, containers and runtime traffic. Hackly does not see AWS, GCP, Azure or a cluster. Authenticated DAST and API fuzzing are products there. A Hackly penetration test can submit one declared test account, once, on a host whose target is already DNS-verified. Aikido reports inside CI. Hackly runs when someone starts a scan: there is no pull-request check and no recurring scan schedule.

Noise handling is smaller here on purpose. Findings are deduplicated across tools, some unreachable PHP dependencies are marked, and placeholder secrets are dropped. That is a heuristic for Laravel apps, not a general false-positive engine. Aikido advertises aggressive noise reduction. This page does not repeat that as a measured result.

Part of Aikido's surface testing is Nuclei-based. Hackly runs Nuclei too, along with nmap, OWASP ZAP, Nikto and WPScan. The engines are not the difference. The difference is everything wrapped around them, and whose machine the job runs on.

Hackly is the tighter fit when the findings have to stay on a server you administer and the apps are Laravel. The license is MIT. Findings, GitHub tokens and raw scanner output stay there. You pay with the host, the binaries and a queue worker. Every domain scan waits for a DNS TXT record that proves control of that name. Aikido's attack-surface module watches assets you connect. Hackly refuses a hostname you cannot publish DNS for. That gate is the reason the tool exists, and it is a limitation when the asset is a tenant you do not control.

Repository scanning is aimed at PHP and Laravel: Composer audit, OSV, abandoned packages, Laravel outside security support, the Checkpoint checks, Semgrep with p/php, Trivy and Gitleaks. A Python or Go monorepo gets a thin result. The external scan is rate-limited on purpose, so a deep run is slow. Aikido's hosted DAST is faster to turn on, and nobody installs ZAP.

The compliance pages score evidence from findings Hackly already stored. They are a worksheet for an auditor. They are not a certification, and they do not collect policies, vendors or access reviews. Aikido is not that product either.

Detectify

Detectify is a hosted attack-surface and application-testing platform. Surface Monitoring keeps a map of domains, subdomains, addresses, technologies and ports, and tests what it finds. Application Scanning is authenticated DAST, with crawling and payload fuzzing. API Scanning covers REST and GraphQL. Internal Scanning reaches systems off the public internet. PCI ASV scanning is an approved-scanning-vendor test for PCI DSS. The payloads come from Detectify's research and a crowdsourced community of hackers, including a large catalogue of subdomain-takeover checks. They say most of what they report never receives a CVE. That is their research claim. Hackly has not reproduced it.

If the job is the public internet, watched continuously, with payloads written by people who look for bugs, Detectify is the specialist. Hackly is not in that race. Subdomain discovery here is a wordlist, certificate-transparency logs and takeover fingerprints. Nothing watches for a new hostname appearing tomorrow, and nothing fuzzes an API the way a dedicated engine does. A penetration test is one authorized run, with one login, then a cooldown. Detectify's application scanning is built to keep going, authenticated, across the surface.

Detectify does not take the repository half of this app. There is no Semgrep, Trivy, Gitleaks or Composer audit in that product, and no Laravel-specific code checks. The service runs on their side. Hackly's PCI DSS page is one of the evidence packs in Compliance. It is not an ASV scan, and a bank that asked for an ASV will not accept it. Use Detectify, or another ASV, when that is the requirement.

The two can sit side by side. Detectify on the public surface you want watched every day. Hackly on the GitHub repository, and on the hosts where you can prove DNS and you want the raw Nuclei, ZAP and Composer output on your own disk. Intruder and Probely sit in the same hosted-external neighbourhood: someone else's payloads, no Laravel SAST.

Choosing between Aikido and Detectify is a separate question. Aikido is the wide platform, from the pull request to the cloud account. Detectify is the external-testing specialist. Hackly is the small self-hosted one. A team that already pays for one of the first two can still want the property Hackly actually has: the scanner output, and the GitHub token, stay on a machine they run.

The rest of the neighbourhood

What this page will not pretend

• Hackly orchestrates nmap, Nuclei, ZAP, Nikto, WPScan, Semgrep, Trivy, Gitleaks, Checkov and Composer. Those projects own the detection. Hackly owns the queue, the history, triage that survives the next scan, the link between a domain and a repository, and the DNS gate.
• A one-off Nuclei run does not need this application installed.
• A human penetration test, a GRC suite, a WAF and a cloud-posture product remain separate purchases. The compliance score is not any of those.
• SAST here is PHP-shaped. Semgrep starts from p/php. Checkpoint and the Laravel checks assume a Laravel tree. Other stacks are second-class, and saying otherwise would be advertising.

Requirements

• PHP 8.3+
• Composer
• SQLite (default) or MySQL / PostgreSQL
• git (for repository clones)
• Node.js (optional — only for the Vite dev server; panel styles are plain CSS)

Scanner binaries

Target scanners

Optional but recommended. Without them, related tasks fail gracefully and surface missing-binary errors in the scan UI.

sudo bash scripts/install-scanner-binaries-ubuntu.sh
php artisan hackly:check-binaries

Repository scanners

Needed for GitHub repo scanning. Missing tools cause those tasks to be skipped (other tasks still run). Composer/OSV and Hackly Laravel auditors do not require Semgrep/Trivy.

sudo bash scripts/install-repo-scanners.sh
php artisan hackly:check-binaries

Targets

Admin UI

1. Targets → Add target — enter a domain (a pasted URL is normalized)
2. Publish the TXT record shown on the target page at your DNS provider
3. Check DNS — once the token is found the target is unlocked
4. Start scan — pick a profile. Also scan linked repositories is already on when a repository is linked
5. Follow progress live on the scan page; triage its findings or export a PDF / Markdown report
6. The target page groups Findings, Scans and Linked repositories

The DNS dialog shows the scanner IP. Allowlist it if the host drops unknown clients. Set HACKLY_EGRESS_IP when the worker cannot detect its own address. Targets do not need a linked repository.

CLI

php artisan hackly:scan example.com --profile=standard
php artisan hackly:scan example.com --include-repos

Repositories

Admin UI

1. Settings → GitHub tokens → Add token (or create one inline while adding a repository)
2. Repositories → Add repository — owner/repo or a github.com URL, checked against the GitHub API
3. Link the Targets where this code is deployed. The same link appears in compliance as one line, and a penetration test scans that code with the host
4. Scan now — pick a profile. Also deep-scan linked targets is already on when a linked target is verified (DAST plus live Laravel probes)
5. Review findings and scan history on the repository page; export reports from any scan

Repository findings belong to the repository, not to a target, so a repository can be scanned without any linked domain.

GitHub token permissions

Post-processing

• Cross-tool deduplication (e.g. same package + CVE from Trivy and OSV → one finding)
• PHP reachability: namespace usage in app/, routes/, config/; require-dev → unreachable; Laravel package auto-discovery
• Noise filters: placeholder secrets, path out of app scope, configurable rule suppressions
• Findings store reachability, confidence, noise_filtered, and tools[]

CLI

php artisan hackly:repo-scan owner/repo --profile=standard
php artisan hackly:repo-scan owner/repo --include-targets

Linked apps

A link says “this repository is what runs on this domain”. Create it from Linked repositories on the target, Linked targets on the repository, or Linked repositories on a penetration test. The API uses PUT /api/v1/targets/{id}/repositories and PUT /api/v1/repositories/{id}/targets. repository_ids on a penetration test writes the same link.

Penetration tests

Attack surface → Penetration tests is an engagement, not a profile on Start scan. The target must already be DNS-verified and active. That standing check is the authorization: start the test without publishing another TXT record, and without asking anyone to change DNS for this run. A fresh hackly-pentest= record is only required when the target is not already verified. That extra token lasts HACKLY_PENTEST_AUTH_MINUTES (30) and is consumed when the test starts. There is a cooldown of HACKLY_PENTEST_COOLDOWN_HOURS (6) per target.

The authorization screen shows the scanner IP (the same address as the ordinary DNS check). Allowlist it. Set HACKLY_EGRESS_IP if this server should not look the address up itself.

What you can declare

• Technology: Laravel, PHP, WordPress, Drupal, Django, Rails, Spring, ASP.NET, Node, Next.js, or mixed
• Swagger / OpenAPI URL, login areas, other URLs, and extra ports. Every URL must stay on the authorized host
• One test account. Hackly posts that form once and reviews the session cookie. It does not guess passwords
• Notes, how authentication works, and what is out of scope

What always runs

The declared URLs are extra. The run still covers the whole origin: tech fingerprint, path discovery, TLS, technology surface, the OpenAPI document, the login pages, a fixed professional port set plus the ports you named, Nuclei across Laravel, PHP, frontends, Apache, Nginx and WordPress, WPScan, Nikto, and a longer OWASP ZAP pass. Missing wpscan or nikto skips that task. WPScan is forced only when the technology is WordPress, and it never receives a password list.

Compliance

Security → Compliance scores evidence from scans you already ran. It is not a certification, an attestation, or a legal opinion. A control Hackly cannot observe is out of scope, not a pass.

The posture score starts at 100. Open highs, acknowledged highs, open mediums and lows, unverified targets, and a workspace with assets but no completed scan in 30 days each reduce it. The method is printed on the page and in the report.

Scope

All is the whole workspace. Every other line is one subject:

• a target with no repository, shown as the domain
• a repository with no target, shown as owner/repo
• a linked pair, shown as shop.example.com + acme/shop

The grade, the framework cards and the PDF / Markdown downloads follow that line. A pair includes findings on the domain and findings on that repository.

Packs

DORA, SOC 2, NIS2, ISO/IEC 27001, PCI DSS, GDPR, NIST CSF 2.0, OWASP Top 10, CIS Controls v8, HIPAA, Cyber Essentials, and the Essential Eight. Each control is met, partial, a gap, not assessed, or out of scope. API ids: dora, soc2, nis2, iso-27001, pci-dss, gdpr, nist-csf, owasp-top-10, cis-v8, hipaa, cyber-essentials, essential-eight.

Findings & triage

Findings collects every issue from target and repository scans, ranked High → Low. Passed checks are recorded too but hidden unless you enable the Passed checks filter. Click a row to open it in a slide-over and triage it, or select many rows and triage them in bulk.

On the finding, Copy Markdown puts every detail on the clipboard (severity, subject, evidence, and the false-positive note). Copy AI prompt wraps that same write-up in a request for a root cause, a fix, and how to verify it. Share link publishes a read-only page at /f/ plus 40 random characters. Unshare and the old address stops working. The public page can also be fetched as ?format=markdown or ?format=prompt.

Weekly digest

Every Sunday at 08:00 (timezone from HACKLY_DIGEST_TIMEZONE, otherwise the app timezone) Hackly emails every user a digest of the last seven days: posture grade, open findings by severity, what is new, what was fixed or dismissed (with the false-positive note), failed scans, and the situations around the workspace — unverified targets, paused assets, and anything without a completed scan in 30 days. The same snapshot is in the panel notification bell and at GET /api/v1/digest.

The scheduler has to be running. Preview without sending mail:

php artisan hackly:digest --dry-run

API

Personal access tokens live on Profile. Each user sees only their own tokens. Send Authorization: Bearer hk_…. Abilities are * (full, can mint tokens), write (changes, and reads), and read. The interactive reference is the API docs, and a running app serves the same spec at /api/docs. Compliance and posture accept subject. Penetration tests are their own resources: create, authorize, check the TXT, then run. scanner_ip is the address to allowlist.

Issue a token from the shell when you do not want to open the panel:

php artisan hackly:token you@example.com --ability=read

Independent scan modes

Laravel live pentest runs only when the repo scan includes linked targets. Repo-only scans skip it. A penetration test’s linked repository scan is a deep code scan and does not start that live probe again.

Scan profiles

Target (DAST)

Repository (SAST / SCA)

* Live pentest only when linked targets are included. checkpoint runs on every repository profile and records each of the 30 Checkpoint checks. Findings are normalized to LOW / MEDIUM / HIGH.

Penetration test

Not listed on Start scan. Tasks: tech_fingerprint, path_discovery, tls_check, pentest_surface, pentest_api, pentest_login, pentest_ports, nuclei_pentest, wpscan, nikto, zap_pentest, plus a deep repository scan for each linked repository.

Commands

Scans are started manually from the admin UI or CLI — there is no automatic hourly/nightly scan schedule.

Configuration

Primary config: config/hackly.php — override via .env.

QUEUE_CONNECTION=database
CACHE_STORE=database

# Safety
HACKLY_ALLOWLIST_ONLY=false
HACKLY_ALLOWLIST=example.com,203.0.113.10
HACKLY_ALLOW_PRIVATE_TARGETS=true

# Soft rate limits
HACKLY_PER_TARGET_PER_MINUTE=2
HACKLY_GLOBAL_CONCURRENT=5
HACKLY_JITTER_SECONDS=5
HACKLY_TASK_SPACING_SECONDS=10
HACKLY_DEEP_COOLDOWN_HOURS=24
HACKLY_QUIET_HOURS_ENABLED=false

# Job timeout must exceed longest scanner (ZAP ~900s)
HACKLY_JOB_TIMEOUT=960
DB_QUEUE_RETRY_AFTER=1020

# Target binary paths
HACKLY_NMAP=nmap
HACKLY_NUCLEI=nuclei
# macOS: HACKLY_ZAP=/Applications/ZAP.app/Contents/Java/zap.sh
HACKLY_ZAP=zap.sh
HACKLY_NIKTO=nikto
HACKLY_WPSCAN=wpscan
# HACKLY_WPSCAN_API_TOKEN=
# HACKLY_EGRESS_IP=
# HACKLY_PENTEST_AUTH_MINUTES=30
# HACKLY_PENTEST_COOLDOWN_HOURS=6

# GitHub repository scanning
HACKLY_GIT=git
HACKLY_COMPOSER=composer
HACKLY_SEMGREP=semgrep
HACKLY_TRIVY=trivy
HACKLY_GITLEAKS=gitleaks
HACKLY_CHECKOV=checkov
# HACKLY_SEMGREP_CONFIG=p/php
# HACKLY_OSV_ENABLED=true
# HACKLY_REPO_HIDE_UNREACHABLE=false
# HACKLY_REPO_DROP_NOISE=false

Security model

• Target scans require ownership verification (DNS TXT). The scanner IP is shown on that screen
• Penetration tests use that standing check. A second TXT is only required when the target is not already verified, and that token expires and is consumed on start. Declared URLs cannot leave the authorized host
• Repository scans require a GitHub token with read access to that repo
• Linking targets and repositories is optional. Linked scans stay on those assets. WPScan does not guess passwords
• Optional allowlist and private-IP blocking for Targets
• Soft rate limits, jitter, task spacing, and quiet hours
• Deep target profile has a cooldown between runs
• GitHub PATs are stored encrypted at rest (APP_KEY) via the GitHub tokens UI
• Repo workspace clones are removed after finalize when HACKLY_REPO_CLEANUP=true (default)
• Admin accounts support TOTP and email multi-factor authentication
• API tokens are personal. A public finding link is off until you share it, and it does not reveal who published it

Production tips

• Set HACKLY_ALLOW_PRIVATE_TARGETS=false
• Prefer HACKLY_ALLOWLIST_ONLY=true with an explicit allowlist
• Configure real mail for email 2FA (MAIL_MAILER=…)
• Change the seeded admin password immediately
• Store GitHub PATs only via the GitHub tokens UI
• Run both install scripts on the scan worker host, then hackly:check-binaries as the queue user
• Set HACKLY_EGRESS_IP to the address operators should allowlist
• Keep the scheduler running so the Sunday digest is sent and hackly:update-databases refreshes Nuclei, Trivy, and Semgrep data daily
• Run a persistent queue:work, and schedule:work or cron schedule:run

Source and issues: github.com/andreapollastri/hackly