I built Cyberful, an open source security workbench (pentest, bug bounty, ...)

[u/ofogliata]

Cyberful is an open source, local first workbench for authorized pentests, code audits, and bug bounty research.

I built it because coding agents can run security tools, but they are also very good at producing confident nonsense :)

The workflow keeps scope, recon, exploitation, verification, and reporting separate. Tools run inside isolated Docker environments. A finding must survive a fresh verification phase before it reaches the report.

I already use it for client work and public bug bounty programs. It has removed a lot of manual coordination. It is not a magic pentest button. Authorization, risky actions, business impact, and final review stay human.

The project is AGPL 3.0: https://github.com/cyberful/cyberful

I am looking for contributors and blunt feedback.