Skip to content

Commit 1d6ffa3

Browse files
h0tak88rh0tak88r
committed
docs+feat: update AI model, auth docs, and feature table
- AI: switch DefaultModel to z-ai/glm-4.5-air:free (via OpenRouter, free tier) ZAIDefaultModel updated to glm-4.5-air for direct Z.ai endpoint - README: replace Supabase auth reference with native Go JWT + PostgreSQL - README: expand feature table with separate rows for APK Auditor, IPA Auditor, ADB Auditor, and MITM Patch with shoutout to thecybersandeep/apkauditor - README: update AI model line and tip to reflect new provider stack - go mod tidy: clean up unused and misclassified dependencies
1 parent b53d7d6 commit 1d6ffa3

4 files changed

Lines changed: 14 additions & 16 deletions

File tree

‎README.md‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ AutoAR is a powerful, end-to-end automated security reconnaissance and vulnerabi
1616

1717
Results are automatically uploaded to **Cloudflare R2 storage** and linked directly in your output — no hunting through directories.
1818

19-
**Public VPS / dashboard:** configure Supabase-backed login and JWT verification for the HTTP API — see [docs/DASHBOARD_AUTH.md](docs/DASHBOARD_AUTH.md).
19+
**Public VPS / dashboard:** uses native Go JWT authentication with local PostgreSQL — no Supabase required. See [docs/DASHBOARD_AUTH.md](docs/DASHBOARD_AUTH.md).
2020

21+
![Dashboard](image.png)
2122
---
2223

2324
## ✨ Feature Highlights
@@ -33,14 +34,17 @@ Results are automatically uploaded to **Cloudflare R2 storage** and linked direc
3334
| ☁️ **S3 Buckets** | Enumerate and scan AWS S3 buckets for exposure and misconfig |
3435
| 🔗 **JavaScript** | Extract secrets, API endpoints, auth tokens from JS files |
3536
| 🐙 **GitHub Recon** | Org-level and repo-level scanning for secrets, dependency confusion |
36-
| 📱 **Mobile Apps** | Browser-based APK/IPA Auditor — decompile DEX, 80+ security rules, MITM patching, remote fetch by Package ID with R2 download links |
37+
| 📱 **APK Auditor** | Browser-based static analysis: decompile DEX, 80+ OWASP rules, tracker detection, manifest parsing, cert analysis, MASVS export. Credit: [thecybersandeep/apkauditor](https://github.com/thecybersandeep/apkauditor) |
38+
| 🔒 **MITM Patch** | Fetch any Android app by Package ID → auto-patch `network_security_config.xml` → re-sign → R2 download link in one click |
39+
| 📱 **IPA Auditor** | Browser-based iOS IPA analysis: binary strings, plist parsing, secrets detection, framework fingerprinting |
40+
| 🖥️ **ADB Auditor** | Browser-based ADB security tool: USB device inspection, app enumeration, logcat tailing, file pull, activity launching |
3741
| ⚙️ **Misconfigs** | 100+ service misconfiguration checks |
3842
| 🏴‍☠️ **BB Scope** | Fetch scope from HackerOne, Bugcrowd, Intigriti, YesWeHack (token), Immunefi — CLI & **dashboard Targets page** |
3943
| 🔄 **Monitoring** | Subdomain + URL change monitoring daemon with Discord alerts & DB history |
40-
| 🤖 **AI Agent** | Full AI hunt loop (CLI + Discord `/ai` & `/brain`) — powered by **Step-3.5 Flash via OpenRouter (free tier)** — zero cost required |
44+
| 🤖 **AI Agent** | Full AI hunt loop (CLI + Discord `/ai` & `/brain`) — powered by **z-ai/glm-4.5-air:free via OpenRouter** — zero cost required |
4145
| 📤 **R2 Storage** | Auto-upload every non-empty result file to Cloudflare R2 and print the public URL |
4246
| 🔔 **Smart Alerts** | Rich Discord notifications for zero-findings scans — no more empty files or spam |
43-
| 🖥️ **Web dashboard** | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets page, APK Auditor with remote scan, Rescan button, CF-1016 findings |
47+
| 🖥️ **Web dashboard** | **v4.1+** — Stats, scans, domains, monitors, R2 browser, Targets, APK/IPA/ADB Auditors, MITM remote scan, CF-1016 findings |
4448

4549

4650
---
@@ -357,9 +361,9 @@ As of the latest release, AutoAR's AI engine runs on `**[stepfun/step-3.5-flash:
357361
OPENROUTER_API_KEY=sk-or-v1-...
358362
```
359363

360-
That's it. AutoAR will automatically use `stepfun/step-3.5-flash:free` for all `/ai` and `/brain` commands.
364+
That's it. AutoAR will automatically use `z-ai/glm-4.5-air:free` for all `/ai` and `/brain` commands.
361365

362-
> **Tip:** If `OPENROUTER_API_KEY` is set, it is used first. `GEMINI_API_KEY` is a fallback for direct Gemini access. You only need one of the two.
366+
> **Tip:** If `OPENROUTER_API_KEY` is set, it is used first (with `z-ai/glm-4.5-air:free`). `ZHIPU_API_KEY` routes to the Z.ai direct endpoint. `GEMINI_API_KEY` is a final fallback. You only need one of the three.
363367
364368
### Database & Results
365369

‎go.mod‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ require (
2020
github.com/hashicorp/go-retryablehttp v0.7.5
2121
github.com/jackc/pgx/v5 v5.7.6
2222
github.com/joeguo/tldextract v0.0.0-20220507100122-d83daa6adef8
23-
github.com/joho/godotenv v1.5.1
2423
github.com/juju/persistent-cookiejar v1.0.0
2524
github.com/majd/ipatool/v2 v2.2.0
2625
github.com/projectdiscovery/dnsx v1.2.2
@@ -30,6 +29,7 @@ require (
3029
github.com/projectdiscovery/subfinder/v2 v2.6.7
3130
github.com/projectdiscovery/tlsx v1.2.2
3231
github.com/sa7mon/s3scanner v0.0.0-20251106040855-9e26bc46e8ee
32+
github.com/shirou/gopsutil/v3 v3.24.5
3333
github.com/sirupsen/logrus v1.9.3
3434
github.com/spf13/cobra v1.10.2
3535
github.com/sw33tLie/bbscope v0.0.0-20251113222800-c453973e83dd
@@ -235,9 +235,7 @@ require (
235235
github.com/sashabaranov/go-openai v1.37.0 // indirect
236236
github.com/schollz/progressbar/v3 v3.13.1 // indirect
237237
github.com/sergi/go-diff v1.4.0 // indirect
238-
github.com/shirou/gopsutil/v3 v3.24.5 // indirect
239238
github.com/shoenig/go-m1cpu v0.1.6 // indirect
240-
github.com/shogo82148/androidbinary v1.0.5 // indirect
241239
github.com/sorairolake/lzip-go v0.3.8 // indirect
242240
github.com/spaolacci/murmur3 v1.1.0 // indirect
243241
github.com/spf13/afero v1.15.0 // indirect

‎go.sum‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -523,8 +523,6 @@ github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i
523523
github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
524524
github.com/joeguo/tldextract v0.0.0-20220507100122-d83daa6adef8 h1:Ig0ESdy6JtHI17vsb7L+UlUFpoZctKfvBZplcILeL6g=
525525
github.com/joeguo/tldextract v0.0.0-20220507100122-d83daa6adef8/go.mod h1:oGfutRjaB95239mjFVwofaOPTwuS3vb71ZLIGCEb36g=
526-
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
527-
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
528526
github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
529527
github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
530528
github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
@@ -818,8 +816,6 @@ github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFt
818816
github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
819817
github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
820818
github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
821-
github.com/shogo82148/androidbinary v1.0.5 h1:7afvcNw+vT84R0ugrL/u/DIrGYylC66yNvt0Y0j7rrM=
822-
github.com/shogo82148/androidbinary v1.0.5/go.mod h1:FzpR5bLAXR3VsAUG4BRCFaUm0WV6YD4Ldu+m05tr9Vk=
823819
github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
824820
github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
825821
github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=

‎internal/modules/brain/brain.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,12 +48,12 @@ type AICommandList struct {
4848
}
4949

5050
const (
51-
DefaultModel = "nvidia/nemotron-3-nano-30b-a3b:free"
51+
DefaultModel = "z-ai/glm-4.5-air:free"
5252
OpenRouterEndpoint = "https://openrouter.ai/api/v1/chat/completions"
5353
GeminiDirectEndpoint = "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent"
5454
ZAIEndpoint = "https://api.z.ai/api/coding/paas/v4/chat/completions"
55-
ZAIDefaultModel = "glm-4.6"
56-
MaxAgentIterations = 20 // increased from 8 — complex hunts need subdomains+live+ports+nuclei+js+gf+validations
55+
ZAIDefaultModel = "glm-4.5-air"
56+
MaxAgentIterations = 20
5757
)
5858

5959
// ─── Agent Loop types ─────────────────────────────────────────────────────────

0 commit comments

Comments
 (0)