`/export` slash command to [OpenHack]

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built

I added a /export slash command to OpenHack, an open-source AI security scanner that runs in your terminal.

Before this, OpenHack could only copy one finding at a time (/copy), and the only report was a raw session JSON file. So the results lived inside the terminal, and the person who ran the scan had to stay there to use them.

/export [sarif|md|json] [path] writes every finding to a file you can take with you:

• SARIF 2.1.0 (default) for GitHub code scanning, GitLab, Azure DevOps and VS Code. Findings are tagged with CWE IDs and severity, and paths are relative to the scanned repo.
• Markdown for a readable report you can paste into a PR, ticket or audit.
• JSON for a full findings dump.

How it gets people off the screen: a deep AI scan takes a while, and you shouldn't have to sit and watch it. Start it, step away, and come back to a finished report you can review on your phone, send to a teammate, or have CI pick up automatically. Exports are safe to share: token-like strings are redacted and exploit payloads are left out of SARIF and Markdown.

Who it's for: developers and small teams running OpenHack on their own code who want results in their existing workflow, not stuck in a terminal session.

Code

https://github.com/aijadugar/OpenHack

Main changes:

• openhack/export.py: new, UI-free module with the SARIF/Markdown/JSON builders and an atomic file writer
• openhack/tui.py: thin /export handler plus command-table and tip entries
• tests/test_export.py: 31 new tests (the full suite is 542 passing)
• README.md: command table row and a short "Exporting findings" section

How I Built It

OpenHack is a Python TUI (prompt-toolkit and rich) that runs a multi-agent scan pipeline against your codebase and works with several LLM providers. /export doesn't call a model. It's a deterministic transform over the findings the agents already produced.

Design choices worth mentioning:

• Pure module, thin command. All the logic is in export.py with no TUI imports, so it's unit-tested directly. The TUI handler is about 40 lines.
• Follows the repo's CLI contract. AGENTS.md says new functionality belongs inside the interactive agent, not as a new subcommand, so this is a slash command and not openhack export.
• Built for sharing. It reuses the project's existing redact() helper, omits PoCs from shared formats, writes atomically (temp file and rename), and creates owner-only files.
• Correct for real consumers. GitHub rejects line 0, so unknown lines default to 1. OpenHack's built-in fingerprint is category plus file only, which would merge distinct findings in one file, so the export hashes in the title too.

Why Does Open Innovation Matter?

Security tooling is a place where trust matters, and open source makes that trust checkable. With OpenHack you can read exactly what the scanner does, and I could add a feature to it without asking anyone's permission or waiting on a vendor roadmap.

The feature itself is also about openness: SARIF is an open standard, so findings aren't locked into one tool's UI. Exporting to a standard format means the same results work in GitHub, GitLab, VS Code or whatever you use next. A closed scanner tends to give you its own dashboard, but here I could make the output portable.