News for hackers. Stuff that matters.

Show HN: Heron is open-source security auditor that interviews your AI agents

https://github.com/theonaai/Heron

Last week security guy in our company asked me to write doc with information about how they work, which data and systems it touches for all my AI agents. "It's too much work" i thought. So i built Heron. It interviews your agent with 10 main questions and smart follow-ups if feel uncertainty. It also has regulatory flags (SOC2, GDPR, EU AI Act etc). As a result you get a full report with all needed information.

Feel free to try. No SDK, no code changes, MIT licensed. Have 4 modes (server, override, scan, skill). Would love feedback and PRs. I hope you find it helpful.

Repo: https://github.com/theonaai/Heron

( 6 comments | 2 points | on HN )
Re:Show HN: Heron is open-source security auditor that inter... by IlyaIvanov0 on Wednesday April 08, 2026 @09:08AM (#47689684)
Hi, author here. Would love to answer any questions you have.
Re:Show HN: Heron is open-source security auditor that inter... by Tarcroi on Wednesday April 08, 2026 @09:41AM (#47690114)
Can this be run a second time and compared against a previous audit?
Re:Show HN: Heron is open-source security auditor that inter... by IlyaIvanov0 on Wednesday April 08, 2026 @09:57AM (#47690298)
Curious, are you thinking about this for continuous monitoring, or more for before/after comparison when agent get updated?
Re:Show HN: Heron is open-source security auditor that inter... by Tarcroi on Wednesday April 08, 2026 @05:34PM (#47696581)
Both. In my opinion, an agent has a life cycle and needs observability.
Re:Show HN: Heron is open-source security auditor that inter... by IlyaIvanov0 on Thursday April 09, 2026 @12:27AM (#47699271)
It's true. Make sense
Re:Show HN: Heron is open-source security auditor that inter... by IlyaIvanov0 on Wednesday April 08, 2026 @09:54AM (#47690258)
Thanks for asking. Not yet, but it is in backlog. I will be doing this in the future.