Code is being written faster than ever, and attackers are using AI agents to find vulnerabilities in it and push malicious dependencies into open source, often before maintainers even see the issue.
Six years ago, the median time-to-exploit of a vulnerability was 1.5 years. Today, that number is -18 hours. That means the median vulnerability is exploited 18 hours before disclosure, according to Zero Day Clock, which uses CISA and VulnCheck data:
Today we’re opening up Hacktron Review for Open Source: the same PR security reviewer we ship to commercial teams, free for qualifying open source projects.
What it looks like
Hacktron Review installs as a GitHub App and reviews every PR opened by project maintainers.
Hacktron posts findings as inline comments on the offending lines, with reproduction context.
Every triage comment your team leaves becomes training signal, so Hacktron adapts to your project’s threat model and raises fewer false positives over time.
When a fix lands, Hacktron detects it and closes the finding.
Drop a
.hacktron/rules.mdfile in your repo to teach Hacktron your auth patterns, trusted sources, or code paths to ignore.
Hacktron Review inline findings and auto-resolution
Why we’re doing this
We’ve spent the past few months using Hacktron to hunt 0-days in popular open source projects. For each finding, we replayed the offending PR through Hacktron Review to see if the bug could have been caught before merge, and it caught the criticals.
Hacktron Review replaying vulnerable pull requests
Attackers already point AI agents at open source code, and giving maintainers the same capabilities on their own PRs feels like the right thing to do.
How to apply
If you maintain an open source project and want Hacktron Review on your PRs, head to hacktron.ai/open-source and submit your repo.
You’ll need to be an owner or admin who can install GitHub Apps. We’re currently prioritizing actively maintained projects with meaningful downstream usage. We’ll review your application and get you set up.