Critical Severity
Published: Oct 26, 2026
Open-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.
<p align="center">
<img src="docs/assets/banner.png" alt="summit" width="760">
</p>
<p align="center">
<a href="https://github.com/pennacle-security/summit/actions/workflows/tests.yml"><img src="https://github.com/pennacle-security/summit/actions/workflows/tests.yml/badge.svg" alt="CI status"></a>
<a href="https://github.com/pennacle-security/summit/releases"><img src="https://img.shields.io/github/v/tag/pennacle-security/summit?label=release&color=2ea44f" alt="release"></a>
<a href="https://pypi.org/project/summit-scanner/"><img src="https://img.shields.io/pypi/v/summit-scanner?label=pypi&color=306998" alt="PyPI"></a>
<a href="https://www.bestpractices.dev/projects/15532"><img src="https://www.bestpractices.dev/projects/15532/badge" alt="CII Best Practices"></a>
<a href="https://api.scorecard.dev/projects/github.com/pennacle-security/summit/badge"><img src="https://api.scorecard.dev/projects/github.com/pennacle-security/summit/badge" alt="OpenSSF Scorecard"></a>
<a href="https://pennacle-security.github.io/summit/"><img src="https://img.shields.io/badge/docs-live-2ea44f" alt="docs"></a>
<img src="https://img.shields.io/badge/python-3.10%2B-3776ab" alt="python 3.10+">
<img src="https://img.shields.io/github/license/pennacle-security/summit?color=8b949e" alt="MIT license">
<img src="https://img.shields.io/badge/dependencies-3%20core%20%2B%201%20optional-8b949e" alt="dependencies">
</p>
<p align="center">One scriptable CLI for web security testing: scanner, TLS-intercepting proxy, fuzzer, authorization testing, WAF analysis, link-hijack detection, race conditions, scheduled monitoring and recon.<br>58+ checks across 11 families, 37 bundled YAML templates, Intruder-style payload fuzzing and a no-traffic attack-surface map. Free where the equivalents are paid - by <a href="https://github.com/pennacle-security">Pennacle Security</a>.</p>
---
We use Burp and ZAP every day. We also kept wanting three things they are not: a scanner we can script agai