Hey HN,

I've been building Spectator for the past year — a purpose-built scripting language for pentesters, red teamers, and security researchers.

Why another language? Most security work is a mix of Bash, Python, and random tools glued together. Spectator unifies that: one language with built-in security modules, a native GUI framework, and a package manager — all compiled into a single binary.

What makes it different:

High-level syntax — Python-like, f-strings, closures, goroutines (spawn). Recon scripts in 5 lines.

Built-in hacking modules — PortScan, SubdomainEnum, SQLiTest, PayloadGen, CORS/SSRF, HTTP fuzzing, crypto, encoding. No pip installs.

Native GUI framework (#Import Spec.GUI) — Desktop tools without Electron. Inputs, tables, tabs, output. Windows (WebView2), Linux (WebKitGTK), macOS (WKWebView).

Space package manager — Libraries like coffee (recon) and ghost (OSINT) are SHA-256 verified. Blocks supply-chain attacks.

Mission engine — Pentest workflow with HTML report generation.

Cross-compilation — spectator build script.str to app.exe for windows = standalone binaries.

Example — GUI port scanner (complete tool):

spectator #Import Spec.GUI open.window({"title": "Port Scanner", "bg": "#070b14", "accent": "#00d4aa"}) GUI.input("target", "Enter target...") GUI.button("Scan", "run_scan") GUI.progress("bar") GUI.output("out", {"height": 380})

GUI.on("run_scan", func() { target = GUI.get("target") GUI.print("out", "Scanning " + target) ports = [21,22,23,80,443,3306,8080] each p : ports { if hasPort(target, p) { GUI.print("out", "OPEN " + str(p)) } } }) end() Current state:

v2.0.0 — stable CLI/TUI across Windows, Linux, macOS

GUI fully functional on Windows; Linux/macOS GUI works (WebKit vs WebView2 differences)

~177 built-in functions, written in Go

Space registry live, anyone can publish

What I'd love feedback on:

Does the syntax feel intuitive? (string concat --> is unusual but I like it)

GUI approach — native desktop vs web-based?

Package manager security — SHA-256 verification enough?

What modules would make you actually use this?

I know the security tooling space is crowded, but there's room for a language built for this domain rather than adapted.

GitHub: https://github.com/CzaxStudio/Spectator Docs: https://github.com/CzaxStudio/SpectatorDocs/

Appreciate any thoughts, criticism, or wild ideas.

XReplicator – eBPF-based server backups that track only changed disk sectors

Internet 3.0: empty gardens and the software boom

Wittgenstein and the Paradoxes at the Limits of Language

Financialization

The Digital Imprimatur (2003)

Sharing: I gave my OpenClaw a voice. I can't go back to typing

Blockchain Social Media

Major upgrades to Ray Serve: 88% lower latency and 11.1x higher throughput

Mapterhorn

PolyShell attacks target 56% of all vulnerable Magento stores

Built a smartplate bentop prototype that can analyze food automatically

HDP: An open protocol for verifiable human authorization in agentic AI systems

The Unreasonable Effectiveness of Linear Search

Vogue is barking up the wrong tree with lawsuit, says Dogue creator

Data is everywhere. The government is buying it without a warrant

CoolIT's employees to get cash payouts with $4.75B sale to Ecolab

Rule based automation vs. Agentic AI system

Permanent Injunction Bars CDC, CISA from Coercing Social Media on Free Speech [pdf]

A Geometric Resolution of the Vacuum Catastrophe via 3-Torus Topology

How are teachers handling writing feedback at scale?

LiteLLM Supply Chain Attack: Defense in Depth Is the Only AI Security Strategy

Zipcode specific inflation to understand local price changes

Show HN: Spectator – A programming language for Cybersecurity and Hacking

Spotting issues in DeFi with dimensional analysis

Iran rejects US proposal, lays out five conditions for ending war

OmniWM – Niri and Dwindle tiling window manager for macOS

Should Investors Demand Better Liquidation Terms for SAFEs?

Injecting Tracing the Hot Way

The coming PLG to SLG apocalypse

Ask HN: Can I somehow exit HN desktop view on mobile?