01Recon
bounthunt
Recon automation for scoped asset discovery. Built to chain subdomain, endpoint and parameter checks into one repeatable run.
Focus
- Subdomain discovery
- Endpoint discovery
- Parameter analysis
- Reporting
Security tooling · Web & AI products
Security tooling builder for recon, APIs and GraphQL.
Plus web products, automation and AI-assisted business systems.
01 — Console · interactive
Interactive console
try:
02 — Selected tools
Four tools, one workflow: discover → validate → report.
Each tool covers one stage of practical security research. Built in Python, MIT-licensed, usable independently.
02GraphQL
gqlhunter
GraphQL discovery and security analysis. Built for pulling introspection schemas apart — fields, auth gaps, risky query depth.
Focus
- Introspection extraction
- Field fuzzing
- Depth & complexity analysis
- Auth analysis & risk classification
03REST API
apihunter
REST API discovery, heuristics and reporting. Maps OpenAPI surfaces, checks auth and misconfigurations, writes the report.
Focus
- OpenAPI / Swagger discovery
- Heuristic checks (IDOR, CORS)
- Authentication auditing
- HTML / Markdown / SARIF reports
04Mutation evidence
mutvera
Mutation testing of security test suites for FastAPI webhook receivers. Controlled defects are injected into isolated copies of the project, then your existing test suite is re-run — the output shows what the suite actually catches, and what it misses.
Focus
- Six targeted operators + control
- JUnit evidence · HTML/Markdown/SARIF
- SQLite-persisted runs · RU/EN UI
- Detection-only — not a vuln scanner
MIT-licensed · public source · synthetic demo protocol.
GitHub
03 — Web & AI products
Web products, automation and AI systems.
A second line of work, separate from the security toolkit: production websites and an AI-assisted business system.
P·01AI system
AI-admin
AI-assisted business system for client conversations, bookings and owner handoff. Built around Telegram, an owner dashboard and automated booking flows.
What it handles
- Client conversations
- Booking flow
- Owner notifications
- Human handoff
- Owner dashboard
- Next.jsTypeScriptTelegram
Private codebase — walkthrough on request.
Request a walkthrough
P·02Web
Web projects
I build landing pages, business websites, developer portfolios and interactive pages. Selected work lives in my developer portfolio.
Type of work
- Landing pages
- Business websites
- Developer portfolios
- Interactive product pages
- Automation-connected interfaces
Live demo examples
Demo examples with fictional content. Barbershop demo is bilingual (RU/KZ).
See web work04 — Evidence
Examples from apihunter.
Discovery, heuristic scan and the generated HTML report.
More screenshots live in each repository's docs/screenshots. If an image fails to load, the repository remains the source of truth.
05 — About
Security tooling builder.
I'm bess1lie. I build security tools for recon, API and GraphQL work — small Python CLIs I run myself.
Outside security tooling, I build websites, automation and AI-assisted products for real business workflows.
Current focus
Current focus
- Currently buildingSecurity tooling — recon, API and GraphQL analysis. Plus AI-assisted business workflows, websites and automation.
- Research focusAttack-surface discovery, finding validation and reporting that stays in scope.
06 — Principles
How the tools are built.
P·01
Detection-first
Identify issues and report them clearly — no exploitation automation.
P·02
Scope-aware
Tools stay inside the scope you configure.
P·03
Open-source
MIT-licensed. Source is public and issues are welcome.
07 — Install
Install from source.
Python ≥ 3.11. Each tool installs from source and runs independently.
bash
# Install from source (Python ≥ 3.11) git clone https://github.com/bess1lie/apihunter.git cd apihunter && pip install . git clone https://github.com/bess1lie/bounthunt.git cd bounthunt && pip install . git clone https://github.com/bess1lie/gqlhunter.git cd gqlhunter && pip install . # Mutation evidence for your security suite git clone https://github.com/bess1lie/mutvera-public.git cd mutvera-public && pip install -e ".[demo]" # First run (example targets) apihunter discover https://api.example.com bounthunt scan scope.yaml gqlhunter discover https://example.com/graphql mutvera prove --scope mutvera.yaml --property WH-DEDUP-001
08 — Contact
Get in touch.
Security tooling, web projects, automation and technical collaboration. GitHub is the fastest way to reach me.