DEV Community: Dendi Prayogo Hidayat

Building a Zero-Cost, NDA-Compliant Security Report Generator with Local Gemma 2B.

Dendi Prayogo Hidayat — Tue, 13 Oct 2026 10:48:51 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

As a cybersecurity freelancer on platforms like Fastwork, running vulnerability scans (like Nmap) on a client's infrastructure is the easy part. The real bottleneck is the unbillable hours spent translating raw, technical terminal logs into a professional, easy-to-understand Executive Summary PDF that business owners are actually willing to pay for.

I built the Local SecOps Reporter, an automated Command Line Interface (CLI) pipeline that solves this problem. It orchestrates live Nmap scans, streams the output in real-time, analyzes the vulnerabilities, and instantly exports a beautifully formatted, branded PDF report ready to be invoiced to the client.

The target market? Fellow penetration testers, bug bounty hunters, and freelance security consultants who want to automate their reporting workflow without compromising client data.

Demo

*If the video doesn't load, please refresh the website.

Code

xdendix / local-secops-reporter

Local SecOps Reporter

An AI-powered, completely offline Command Line Interface (CLI) tool designed for Cybersecurity Freelancers and Penetration Testers. It automates the process of running Nmap scans and generating professional, client-ready Executive Summary PDFs using a local LLM.

Built for the Hacktoberfest 2026 "Side Hustle" Challenge.

Why This Exists (The Side Hustle)

As a cybersecurity consultant, scanning a client's infrastructure is fast, but writing the report takes hours. However, feeding sensitive client infrastructure data (like vulnerable open ports) into third-party APIs like ChatGPT is a massive breach of Data Privacy and Non-Disclosure Agreements (NDAs).

This tool solves that by utilizing Google's Gemma 2B open-weight model running 100% locally on your machine.

Absolute Data Privacy: Zero data leaves your laptop.
Zero Cost: $0 API costs, maximizing freelance profit margins.
Client Ready: Automatically converts the AI output into a beautifully formatted PDF with customized agency branding.

Features

End-to-End Automation: Runs Nmap, captures…

View on GitHub

How I Built It

This tool is built completely around open-source AI and runs 100% locally on my Ubuntu machine.

The AI Engine: I used Google's open-weight Gemma 2B model running locally via Ollama.
The Pipeline: Written in Python, utilizing subprocess to stream live Nmap scanning data directly into the system's memory.
The Prompt Engineering: The Gemma model is guided by a strict System Prompt to act as a Senior Security Analyst, preventing hallucinations and formatting the output strictly as a Markdown table.
The Polish: I used the rich library for a beautiful terminal UI (with loading spinners) and markdown-pdf to automatically convert the AI's Markdown output into a client-ready PDF equipped with dynamic CLI-injected branding (e.g., --client "Acme Corp").

Why Does Open Innovation Matter?

For this specific side hustle, open innovation isn't just a "nice to have"—it is a legal requirement.

When auditing client infrastructure, revealing their exposed ports, IP addresses, and vulnerable software versions to a third-party, closed-source API (like OpenAI) is a massive breach of Data Privacy and Non-Disclosure Agreements (NDAs).

By utilizing an open-weight model like Gemma running entirely offline on my local machine:

Absolute Data Privacy: My clients' sensitive infrastructure data never leaves my laptop. It is 100% NDA compliant.
Zero Cost Economics: Running inference locally means I pay $0 in API fees, which turns the time saved on reporting into a 100% profit margin for my side hustle.

Closed APIs would have made this business model legally and financially unviable.

Prize Categories

I am submitting this project for the following category:

Best Use of Gemma: The project heavily relies on Google's Gemma model running locally to perform the heavy lifting of security log analysis and report generation.

Less Screen, More Green: Meet EcoTrace AI

Dendi Prayogo Hidayat — Sat, 10 Oct 2026 08:58:53 +0000

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 1: Touch Grass

What I Built
EcoTrace AI is a nature guide on Telegram, designed to help people spend less time looking at their screens and more time noticing the world around them.

When you spot an unfamiliar plant, animal, or track outdoors, you can describe it or send a photo. EcoTrace AI returns a concise field guide with a likely identification, an explanation of its uncertainty, and practical safety advice.

The experience is intentionally simple: ask a question, get a useful starting point, then put your phone away and keep exploring. It is for curious hikers, families, students, and anyone who wants to learn more about a nature encounter without treating AI as an authority.

For photo questions, EcoTrace AI uses a two-step vision-to-text workflow: Moondream describes visible details, then Gemma uses that description and your question to create the guide. Text-only questions go directly to Gemma.

Safety is part of the design. The guide is instructed not to overstate species-level identifications or recommend touching or eating unfamiliar wild organisms. Its answers are suggestions—not a substitute for a local expert.

Demo
*Refresh if the video doesn’t appear

A good demo could show both paths: asking about a nature observation in text, then sending a photo with a question.

Code

xdendix / ecotraceai

EcoTrace AI

EcoTrace AI is a Telegram nature guide for people who are already outdoors. Describe something you found or send a photo, get a cautious identification with practical safety advice, and get back to exploring. It can help with plants, animals, tracks and other nature observations.

Touch Grass challenge

The goal is to make the screen the shortest part of a nature encounter: ask a question or take a photo, read a concise field guide, then put the phone away. EcoTrace AI supports both quick text descriptions and photo-based observations. It asks the model to explain uncertainty, avoid unsupported species-level claims, and never suggest touching or eating an unfamiliar wild organism.

Why open AI

The core inference runs locally through Ollama using open-weight models. For a photo, Moondream describes visible details and Gemma uses that description and the user's question to produce the guide. For text-only questions, Gemma responds…

View on GitHub

How I Built It
EcoTrace AI is built in Python as an asynchronous Telegram bot using python-telegram-bot. The bot handles /start, menu navigation, text questions, and photo messages.

The AI inference runs locally through Ollama:

Text: Gemma (gemma2:2b by default) generates a concise nature guide from the user’s description.
Photos: Moondream describes visible features without naming the subject; Gemma then uses those observations and the user’s question to write the final answer.
This separation gives each model a focused role: one describes what is visible, while the other turns that description into a cautious, useful response. The text model can be changed through the DEFAULT_MODEL environment variable.

Photo files are downloaded temporarily for analysis and removed afterward. Local inference does not mean the entire app works offline: Telegram still needs an internet connection to deliver messages. Sentry can also be enabled for error reporting and tracing.

Why Does Open Innovation Matter?
Open innovation makes this project’s most important choice possible: running AI inference on a machine the user controls instead of sending prompts and photos to an external AI inference API.

With open-weight models and Ollama, the model setup and guiding instructions can be inspected, changed, and adapted. The two-model workflow is also easy to experiment with: developers can swap the text model or vision model and see how those choices affect the experience.

That flexibility matters for a nature guide. Its job is not just to produce a confident-sounding answer; it should communicate uncertainty and encourage safer decisions outdoors. Open tools make those behaviors easier to examine and improve.

Prize Categories
Best Use of Gemma
Best Use of Sentry Agent Tracing

Why open a laptop when you can run recon from your phone? For this MLH Hackathon, I built an asynchronous Telegram bot using Python to automate web security audits. Try it out and let me know what you think!

Dendi Prayogo Hidayat — Mon, 05 Oct 2026 15:17:07 +0000

Dendi Prayogo Hidayat

Oct 5

Building SecOps Recon Bot: Enterprise-Grade Web Auditing via Telegram

#mlhacks #devchallenge #hackathon

3 min read

Building SecOps Recon Bot: Enterprise-Grade Web Auditing via Telegram

Dendi Prayogo Hidayat — Mon, 05 Oct 2026 14:54:48 +0000

This is a submission for the MLH x DEV Writing Challenge

What I Built
I built SecOps Recon Bot, an automated, asynchronous Telegram bot designed for enterprise-grade web reconnaissance and objective security auditing.

What it does
It allows security analysts, pentesters, and CTF players to perform rapid reconnaissance directly from their phones via Telegram. The bot features three main modules:

HTTP Security Headers Audit: Analyzes critical headers (HSTS, CSP, etc.) with automatic protocol fallback and final URL resolution.

Cookie Security Inspector: Audits session cookies for missing Secure and HttpOnly flags.

Sensitive Path Scanner (Dir-Buster Lite): Concurrently brute-forces exposed administrative endpoints (e.g., .env, .git/HEAD) while smartly filtering out generic 301/302 catch-all redirects to prevent false positives.
Finally, it uses Zero Disk I/O to generate a beautifully formatted Markdown report directly in memory and sends it as a downloadable file.

What inspired it
During CTFs and bug bounty hunting, I realized that firing up heavy desktop tools (like Burp Suite or dedicated terminal scanners) just to do a quick initial recon on a target is highly inefficient. I wanted a tool that lives in my pocket, works instantly, and delivers professional, objective data without the noise of false positives.

What I learned
I leveled up my Python architecture skills significantly. I learned how to seamlessly blend synchronous I/O operations (like the requests library) with asynchronous non-blocking frameworks (aiogram) using ThreadPoolExecutor. I also learned how to enforce strict type-guarding with Pylance and how to properly handle HTTP redirect blind spots to ensure the bot always reports the final resolved URL.

Demo
Here is a look at the bot's interface and the Enterprise Markdown Report it generates:

Check out the source code on GitHub:

xdendix / secops_recon_bot_telegram

SecOps Recon Bot

An automated, asynchronous Telegram bot designed for enterprise-grade web reconnaissance and objective security auditing. Built as a submission for the MLH Community Event.

Overview

SecOps Recon Bot is a Red Teaming and Web Security utility that allows security analysts to perform rapid, concurrent reconnaissance directly from Telegram. It is engineered with strict type checking, robust error handling, and Application Performance Monitoring (APM) to ensure production-level stability.

Core Capabilities

HTTP Security Headers Audit: Objectively analyzes critical security headers (e.g., HSTS, CSP, X-Frame-Options) with automatic protocol fallback (HTTPS to HTTP) and final URL resolution.
Cookie Security Flag Inspector: Scans target responses for missing Secure and HttpOnly flags on session cookies.
Sensitive Path Scanner (Dir-Buster Lite): Utilizes thread-pooling to concurrently brute-force common administrative endpoints and sensitive files (e.g., .env, robots.txt, .git/HEAD) while intentionally filtering out generic 301/302 catch-all redirects to eliminate false positives.
In-Memory Report Generation: Concurrently…

View on GitHub

Partner Technologies
Sentry (Application Performance Monitoring & Error Tracking)
To ensure this tool meets enterprise standards, I integrated the Sentry SDK deep into the application's core. Rather than just wrapping the bot in a generic try-catch block, I utilized Sentry's start_transaction and start_span features to monitor specific reconnaissance operations.

For example, during the concurrent Sensitive Path scanning, Sentry tracks the performance of the thread pool and monitors HTTP client spans. If a target server drops the connection or times out, Sentry instantly logs the deadline exceedance or internal errors without crashing the bot's main polling loop. This gave me incredible visibility into how the bot performs under the hood when scanning slow or heavily protected targets.

Hackathon Experience
I built this for the MLH Community Event (CEV). The atmosphere was incredibly inspiring—seeing hackers from all over the world turning ideas into reality pushed me to not just "make a bot that works", but to engineer a production-ready application.

My biggest takeaway from this event is the shift in my development mindset. Instead of rushing to build features, I focused on clean code, strict type-checking, handling edge cases (like URL redirects), and writing professional documentation. The sense of community and the drive to build something genuinely useful for the cybersecurity space is what I will remember most about this MLH event!

OpsBuddy: A Privacy-First Local AI SysAdmin Mentor (Built with Gemma, Ollama & Sentry)

Dendi Prayogo Hidayat — Sat, 03 Oct 2026 10:22:21 +0000

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend

What I Built

I built OpsBuddy, a local, privacy-first AI mentor designed specifically for SysAdmin and Linux training in a CLI environment.

I built this for my friend and trainee, Andre, who is currently learning the ropes of server administration. The biggest hurdle for beginners like him is understanding complex error logs without accidentally leaking sensitive server information (like IPs, usernames, or paths) to public cloud AI tools. OpsBuddy solves this by running entirely locally on his machine. It acts as a safe, intelligent sandbox where he can ask technical questions and securely analyze local .log files.

Demo

Here is OpsBuddy in action safely analyzing a local log file, along with the deep-dive performance tracing data captured by Sentry!

Code

xdendix / opsbuddy

View on GitHub

How I Built It

OpsBuddy is built around a fully open-source and local stack:

AI Model: Google's Gemma 2B (open-weight model) for fast, concise, and accurate technical mentoring.
Local Inference: Ollama to run the LLM efficiently without internet access.
Logic & UI: Python combined with the rich library for a beautiful, colorful CLI experience.
Agent Tracing: Sentry SDK to monitor the AI's performance. I implemented start_transaction and start_child spans to track the exact latency of the local inference streaming process whenever Andre interacts with the agent, ensuring the application remains responsive.

Why Does Open Innovation Matter?

Open innovation is the absolute backbone of this project. By utilizing open-weight models like Gemma 2B and open local harnesses like Ollama, OpsBuddy guarantees absolute data privacy. Andre can command the AI to analyze sensitive SSH, database, or application logs without the fear of that data being sent to a closed, third-party API. Open innovation made it possible to build a capable, free-to-use mentor that respects user data sovereignty.

Prize Categories

Best Use of Gemma
Best Use of Sentry Agent Tracing