Manifesto
nyaack is not a toy and not a pentest. Compile ≠ name ≠ attack.
The other side of a click
There is a world we usually do not see. A URL is a door: behind it sit DNS, certificates, hops, files left in the open, a wall that answers instead of a page. Most tools either flatten that world into a score, or they ask for permission to break in. nyaack was born in the gap: it makes the outside visible, and it says where the view stops. Beyond one horizon there is always another. Looking is not forbidden. The instrument was missing.
The instrument
nyaack compiles evidence on one HTTP subject: a URL or a host. HTML, headers, and cookies of that resource; DNS and TLS of that hostname. If Deep is on, a browser as well. The report is a portrait of an object seen from outside, then the proof. It is a compiler, not a SIEM and not a map of the internet. The extra is not another check. It is describing the object and its shadow: what kind of origin this is, what was only named, what this pass did not do.
The fence
Compile ≠ name ≠ attack. To compile is to gather what can be observed without entering. To name is to point at a neighbour, a hop, a certificate log, a path in a sitemap, and leave it dark until someone asks for that subject. To attack is another craft. A scan is not an organisation. An offsite hop is a name, not a second dossier. A bot wall is the subject, occluded: it is not the app behind it. What this scan did not do stays on the page. Coverage is not a footnote. It is the product.
How it speaks
Facts, hypotheses, and hygiene are not the same sentence. A missing CAA is not a breach. A timeout is not an incident. A confirmed fact is not a suspicion with better type. The number from 0 to 100 is a summary. The verdict is the line: what was confirmed, what is only a signal, what was not run. Reason codes stay stable, so someone who knows the work can triage without trusting marketing copy. There is no generated summary of the report. If the dossier cannot be read, the dossier is wrong.
What it will not become
No port scan, no Nuclei, no login on the target, no dumping of secrets, no crawl of a thousand paths, no fan-out that lights every named neighbour by itself. nyaack does not sell a warehouse of IP intelligence. It does not stamp a site as safe. It does not pretend a guest pass saw Certificate Transparency, LeakIX, or a browser. Watch is a compile, repeated: an alert names a fact already compiled, not an attack nyaack discovered. A pentest, if it ever exists, is another product and another name.
Who it is for
nyaack is an optic for whoever has to explain to a human where a click ends. A delivery, a look from outside, the question of clone or same world. It does not replace a test that enters. It is not a crawler of sites. It is not a feed for machines that want a yes or a no. The method is public. Anyone who knows the field should be able to read a report and decide whether to trust the instrument.
The next horizon
The work is not to scan more. It is to keep the edge visible while the instrument grows: a constellation instead of a map, a portrait instead of a list, a watch that does not become a SOC. nyaack stays small. Alpha means the baseline is as-is: honest, unfinished, the same contract. The next horizon needs an instrument, not permission.