AETHER doesn't just scan. It thinks, plans, executes, and validates exploits against live targets using AI-powered reasoning, then generates production-ready remediation patches.
AETHER is a Security-as-a-Service platform that autonomously discovers, validates, and remediates web application vulnerabilities. It replaces static rule-based scanners with an agentic reasoning loop that mimics how a senior penetration tester approaches a target.
Target URL --> Recon --> AI Planning --> Exploit Execution --> Validation --> Remediation
| | | | |
Tech stack Nemotron 3 Super OWASP Top 10 Confirms Generates
fingerprint generates attack attack lanes with breach with copy-paste
+ passive plan with THOUGHT Playwright-backed evidence security
recon / OBSERVE / PLAN active testing + screenshots patches
| Layer | Technology |
|---|---|
| Frontend | Next.js 16, React 19, TypeScript, Tailwind CSS |
| Backend | Next.js API Routes, TypeScript |
| Database | PostgreSQL 17, Prisma ORM |
| Auth | Custom JWT with magic link authentication |
| AI Orchestration | NVIDIA NIM (Nemotron 3 Super, Llama 3.3 Nemotron, DeepSeek V4 Flash) |
| Browser Automation | Playwright with headless Chromium |
AETHER executes all 10 OWASP Top 10 categories autonomously once consent is verified:
| Category | What AETHER Tests |
|---|---|
| A01: Broken Access Control | Privilege escalation, IDOR, CORS misconfig |
| A02: Cryptographic Failures | Weak TLS, mixed content, certificate validation |
| A03: Injection | SQL injection, XSS, command injection |
| A04: Insecure Design | Business logic flaws, missing rate limiting |
| A05: Security Misconfiguration | Default creds, verbose errors, debug endpoints |
| A06: Vulnerable Components | Outdated libraries, known CVEs |
| A07: Auth Failures | Session management, brute force, token weaknesses |
| A08: Data Integrity | Insecure deserialization, supply chain |
| A09: Logging Failures | Insufficient logging, missing audit trails |
| A10: SSRF | Server-side request forgery, internal network probing |
| Model | Role | Why |
|---|---|---|
| Nemotron 3 Super 120B | Scan planning + final verdicts | 1M context window, reasoning with transparent thought chains |
| Llama 3.3 Nemotron Super 49B | Remediation code generation | 91.3% MBPP score, optimized for security patch generation |
| Nemotron 3 Nano 30B | Content safety filtering | Sub-second response for real-time safety gating |
| DeepSeek V4 Flash | Fast fallback analysis | 284B MoE, ~120 tok/s for high-throughput scenarios |
| Control | Implementation |
|---|---|
| Mandatory Consent | Scans require explicit ownership verification before execution |
| SSRF Protection | Private IPs, loopback, and internal networks are blocked |
| Rate Limiting | Per-IP rate limits on scan creation and API endpoints |
| Quota Enforcement | Per-user scan quotas with tier-based limits |
| Token Rotation | Refresh tokens rotated on every use; all tokens include revocable JTIs |
This project is proprietary software. All rights reserved by the author.
Built with precision. Deployed with confidence.