security · July 2026
PentestFlow
A full-stack Next.js workspace for running authorized penetration tests end to end: scope an engagement, enumerate targets, import Nmap/Nuclei/Burp/ZAP/Nikto output as structured candidates, triage them into CVSS-scored findings with CWE and OWASP mapping, chart the attack path as an interactive graph, and export a print-ready report. It organizes offensive work — it does not exploit: no scanner, no payload delivery, no command execution.
Tornike Kalandadze — software engineer & technical lead, client delivery since 2019 · Tbilisi (GMT+4)
Problem
A penetration test generates scope, targets, raw tool dumps, evidence, findings, and a report — usually scattered across a notes app, a spreadsheet, and a Word template. Nothing links a Nuclei line to a confirmed finding to a CVSS score to the paragraph a client actually reads, and the tooling that promises to help often wants to run scans and payloads itself.
Approach
Build the engagement's system of record and refuse to be a weapon. PentestFlow parses Nmap, Nuclei, Burp, ZAP, and Nikto output as data only — original file preserved — into triage candidates that a human promotes into findings; the CVSS v3.1 score is computed from the vector, evidence sits in a Markdown notebook that strips raw HTML, and the attack path is a React Flow graph that generates its own timeline. Authorization runs through a single per-engagement access checkpoint with an audit log, and the report generator redacts secrets automatically. Security limits are stated in the README, not hidden — in-memory rate limiting, local uploads, no server-side session revocation, app-layer authz.
Impact
A reviewer-ready full-stack product: a typed Next.js 15 App Router app with Prisma/PostgreSQL, Auth.js, per-engagement authorization, safe multi-format parsers, a CVSS calculator, a React Flow attack-path editor, Recharts dashboards, and a print-ready report generator with automatic secret redaction — backed by Vitest units, a Playwright e2e flow, a Dockerized database, and CI. A one-click synthetic demo engagement (Acme Labs) lets anyone walk scope → import → triage → finding → attack path → report without touching a real host.
Through every lens
01 · Full-stack
Full-stack product engineering for the security domain: a typed Next.js 15 App Router app with Server Actions, Prisma over PostgreSQL 16, Auth.js sessions, and per-engagement authorization funneled through a single access checkpoint. Safe multi-format parsers, a CVSS calculator, a React Flow attack-path editor, Recharts dashboards, and a print-ready report generator — shipped with Vitest units, a Playwright e2e flow, a Dockerized database, GitHub Actions CI, and a one-click synthetic demo.
03 · Frontend
The interface carries the product: an interactive React Flow attack-path graph whose nodes and edges hold security semantics and feed an auto-generated timeline, Recharts dashboards for severity and most-affected assets, a Markdown evidence notebook that strips untrusted HTML, and accessible light and dark themes with a dedicated severity palette.
05 · Security
Authorization is the spine: every engagement query passes through one application-layer access checkpoint — no database RLS, a stated limitation — backed by an audit log, in-memory rate limiting, secure headers, and CSRF-safe server actions. Imported scanner output is parsed as data only, the Markdown notebook strips raw HTML via rehype-sanitize, and generated reports auto-redact secrets. It organizes offensive work but never performs it: no scanner, no payload delivery, no arbitrary command execution.
Built with
Next.js 15 · React 19 · TypeScript · Prisma 6 · PostgreSQL 16 · Auth.js (NextAuth v5) · React Flow · Recharts · Zod · Vitest · Playwright
Notes
PentestFlow is the workspace around an engagement, not a weapon inside it. A tester scopes an authorized assessment (client, type, dates, rules of engagement, team), catalogs targets, and imports Nmap, Nuclei, Burp, ZAP, or Nikto output — parsed strictly as data — into triage candidates. Confirmed candidates become findings with a CVSS v3.1 vector (the score is computed for you), CWE and OWASP mapping, impact, and remediation; evidence lives in a Markdown notebook that strips untrusted HTML; and the attack path is an interactive React Flow graph that auto-builds a timeline. The report exports to HTML, Markdown, or print-ready PDF with automatic secret redaction. It ships with a complete synthetic demo engagement so a reviewer can explore the whole product in one click, plus Vitest units, a Playwright e2e flow, and GitHub Actions CI. Honest limits are documented: in-memory rate limiting, local-filesystem uploads, JWT sessions without server-side revocation, and app-layer (not database-RLS) authorization.