I hacked my own website

I sell AI-assisted pentesting tools. So I pointed them at my own production site. Found 13 vulnerabilities, including a publicly readable database containing every license key and customer email I had. Here's the full assessment.

Why audit your own site

Here's the situation. I'd just finished deploying siegeoffense.com — the landing page, the download portal, the admin panel, the license key validation system. Everything worked. Customer flow was smooth. I was feeling pretty good about it.

Then I remembered what I do for a living.

If you sell locks, your front door better be locked. If you sell pentesting tools, you should probably pentest your own infrastructure before someone else does it for you. So I fired up Kali MCP and pointed it at siegeoffense.com with the same methodology I'd use on any client engagement.

It was not a comfortable evening.

Methodology

Standard external assessment. No authenticated testing, no insider access — just what an attacker would see from the outside. The stack is simple: shared cPanel hosting running LiteSpeed, PHP 8.2, static HTML frontend, and a handful of PHP API endpoints handling license validation, downloads, signups, and admin functions.

Tools used through Kali MCP's AI-assisted workflow:

$ nmap -sV -sC siegeoffense.com        # port scan + service detection
$ dirb https://siegeoffense.com /usr/share/dirb/wordlists/common.txt
$ curl -I https://siegeoffense.com      # header analysis
$ curl https://siegeoffense.com/api/    # directory listing check

Plus manual endpoint probing, CORS testing, rate limit verification, and source code exposure checks on every file in the /api/ directory.

The findings

Thirteen total. Three critical, four high, four medium, two low. I'll walk through the worst ones.

The pattern

Look at the root causes. Three criticals and two highs share the same origin: the hardened files existed but weren't deployed. I had built the security controls. They were sitting on my local machine. The production server was running the originals.

This is the most common vulnerability in the industry and it got me too. Not a lack of knowledge. Not a failure of design. A deployment process that didn't verify what was actually running in production matched what was tested locally.

The cobbler's children have no shoes. The pentester's website has no .htaccess.

Remediation

All 11 fixable findings were patched the same night. The remaining two are infrastructure-level (shared hosting limitations on the X-Turbo-Charged-By header and nmap port exposure) and accepted as residual risk.

Post-deployment verification confirmed all 11 fixes working. Total time from discovery to remediation: one session.

Lessons

Audit your own infrastructure first. Before you hand a tool to a customer, point it at yourself. If you're not willing to do that, you're not confident in what you're selling.

Deployment gaps kill. Having security controls doesn't help if they're on your laptop instead of your server. Verify production state, not local state.

The boring findings matter most. Missing security headers and directory listing aren't exciting. They don't make conference talks. They're also the things that let an attacker map your entire attack surface in thirty seconds.

AI-assisted pentesting accelerates the loop. Discovery, analysis, remediation, and verification happened in a single session. The AI didn't find anything a skilled human wouldn't — it just found it faster, and contextualized the relationships between findings that a checklist-based approach might miss. C-1 plus C-3 plus H-4 is worse than the sum of its parts. The AI flagged that chain unprompted.