# nikneuron

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [aditya t](https://cerebralvalley.ai/u/nikaditya)
- **GitHub:** https://github.com/Niknicolas226/nikspider
- **Demo video:** https://youtu.be/4Um4st3xlAM?si=T_GA3SRCNDzH4vTJ
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3929

NikSpider — AI-Triaged AppSec Scanner with a Fix Roadmap

Traditional vulnerability scanners flood developers with raw alerts — most of them false positives, none of them prioritized, and none of them actionable. NikSpider is an ownership-verified, AI-triaged security scanner that turns a messy list of flags into a root-cause-ordered repair roadmap with paste-ready fix prompts and one-click retesting.

Before any scan starts, NikSpider requires cryptographic proof of domain ownership (a DNS TXT record or a well-known file token) — no exceptions. Once verified and scope-locked, a read-only crawler (SpiderEyes) maps the target’s full attack surface, then a planner reasons about what each discovered endpoint actually is — a login form, a GraphQL endpoint, a REST resource — and schedules only the relevant checks across 13 non-destructive probe modules (SQLi, XSS, SSRF, IDOR, CSRF, CORS, security headers, exposed files, and more).

Every raw signal then goes through adversarial debate triage: one AI role argues the case for exploitability, citing the actual HTTP evidence; a second argues mitigating factors or a false-positive explanation; a third, acting as judge, weighs both arguments against the evidence and issues a verdict with a confidence score. The model’s reasoning never has the final word — a deterministic rule engine enforces hard checks on top of it (e.g., automatically rejecting XSS findings where output is HTML-escaped), so the AI supplies nuance while the rules supply the safety guarantee.

Confirmed findings are grouped by root cause — not raw URL — into an ordered repair roadmap with fix steps, code examples, and a one-click retest that re-probes the live target and flips the finding green when the fix actually holds.

In our demo against a seeded-vulnerable benchmark app, NikSpider surfaced 53 raw signals, confirmed 23 real vulnerabilities, correctly rejected 4 false positives, and resolved 8 contested findings automatically — work the team estimates would otherwise take roughly 7 hours of manual triage.

## More from Meta Global AI Developer Hackathon

- [KEREN](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3926)
- [agnts](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3927)
- [UNFOLD](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3928)
- [Mulow](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3930)
- [worksheet-coach](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3931)
- [Icomppower](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3932)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3929. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt