We built https://xitter.cf/t.co/I98Pc28kjm as the web intelligence service for the modern era. Start for free with features for vibe coders all the way through to Enterprise!
London
Joined July 2026
- Tweets427
- Following337
- Followers265
- Likes283
Pinned Tweet
We just made huge improvements to our AI-powered pentesting feature at decloak.dev. It now confirms SSRF, XXE and command injection with real proof, tests every URL and API call a scan finds, and works on single-page apps.
For anyone in cybcersecurity, pentesting and security compliance, check out decloak.dev
1/ The EU Cyber Resilience Act's first obligations kicked in on 11 September.
US vendor questionnaires keep asking about NIST CSF.
Decloak now maps every scan finding to both. That's eight frameworks from one scan.
4/ What it can't do, plainly:
The 24h and 72h reporting duties in Article 14 are processes, not scan findings, so nothing maps to them.
A web scan is supporting evidence for the CRA, not a conformity assessment.
5/ It works on scans you already run. No setup needed.
Full write-up: decloak.dev/journal/complian…
Has anyone asked you about the CRA yet?
1/ A scan says: "missing Strict-Transport-Security header."
An auditor asks: "How do you protect data in transit, and can you show me?"
Someone has to translate. Compliance mapping does it automatically.
4/ Decloak maps findings to SOC 2, ISO 27001, NIS2, DORA, LGPD and PCI DSS v4.0. It's a Pro feature that runs on the scan you already do.
What it isn't: a certification. A website scan only sees what's observable from outside. Policies and processes are still on you.
5/ The full guide, including use cases and limits: decloak.dev/journal/complian…
Which framework do your customers ask about most?
1/ AI models now write code that compiles about 100% of the time.
They still fail security tests in nearly half of tasks.
Veracode tracked 100+ models for a year. The average pass rate moved from 55% to 56%.
4/ Fair caveat: Veracode tested raw models, with no agents, guardrails or human review.
So 56% is how often models generate flaws, not how often flaws reach production.
But AI now writes roughly half of committed code, and the failure rate has held steady.
5/ Our take: treat AI-written code as unreviewed code, and check what actually ships.
Full breakdown, including what the report doesn't prove: decloak.dev/journal/uncloake…
Is AI-written code reviewed differently on your team?
1/ When we launched AI Pentesting, we published what it couldn't do: no SSRF, no XXE, no command injection.
As of today, it confirms all three, with proof.
Here's what changed:
5/ And a confirmed exploit now pulls your overall Security Score down.
It didn't before because the pentest finished after the score was locked in. Now the score is recalculated at the end, and the email waits for the final numbers.
6/ Still not covered: CSRF and access control bugs like IDOR. We'd rather get those right than fast.
Full write-up: decloak.dev/journal/ai-pente…
Which class should we tackle next?