hetty - Moses Yebei

The Problem

Security researchers need an open-source alternative to Burp Suite Pro for intercepting, logging, and replaying HTTP traffic. Hetty addresses that with a self-hosted MITM proxy and web-based admin interface, storing all data locally in a BoltDB file.

What This Does

Hetty runs a single binary that serves three things: an HTTP MITM proxy (pkg/proxy/proxy.go), a GraphQL API (pkg/api/resolvers.go), and a Next.js admin UI (admin/src/pages/). The proxy logs requests and responses, supports scope-based filtering (pkg/scope/scope.go), and allows intercepting/modifying traffic in flight (pkg/proxy/intercept/intercept.go).

The admin interface is organized by feature—sender/ for replaying requests, reqlog/ for searchable logs, intercept/ for live modification, projects/ for workspace management. All data persists to a single BoltDB file via pkg/db/bolt/.

How It Is Wired

Execution starts at main in cmd/hetty/main.go:15, which reaches 6 functions. The traced path is Exec -> OpenDatabase — two hops from entry to the filesystem via bolt.Open in pkg/db/bolt/bolt.go. No database or network edge exists beyond that.

The GraphQL layer is the hub. pkg/api/generated.go defines 296 functions and 8 types, and is called from only 1 other file — it's a generated monolith (8,109 lines) that everything else routes through. pkg/api/resolvers.go (44 functions) is called from 6 files and handles the actual query/mutation logic.

The most-connected functions carry the widest blast radius: UpsertProject (called from 13 places), Close (13), DatabaseFromBoltDB (9), ActiveProject (8). marshalNBoolean2bool is called from 16 places — change its signature and you break a quarter of the GraphQL layer.

The module graph shows no circular dependencies across 106 files and 23 import edges. That's clean. The cost is concentration: generated.go and resolvers.go are where most changes land, and both are already flagged as oversized.

How To Use It

Setup: Build from source with Go modules (go.mod present) or use the Dockerfile. The README documents docker run -v $HOME/.hetty:/root/.hetty -p 8080:8080 ghcr.io/dstotijn/hetty:latest.

Configuration: No env vars required. Flags are defined in cmd/hetty/config.go: --cert, --key, --db (defaults to ~/.hetty/), --addr.

Running it:

hetty --addr :8080

Then open http://localhost:8080 for the admin UI. The proxy listens on the same port.

Real-World Use

For a bug bounty engagement: start Hetty, configure your browser to use it as an HTTP proxy, navigate the target site. Requests appear in the reqlog view with searchable filters (pkg/reqlog/search.go). When you find an interesting request, send it to sender/ to replay with modifications, or enable intercept mode to edit requests before they reach the server.

Code Health & Issues

Static analysis found 27 findings (2 high, 20 medium, 5 low) across 9 kinds:

High — Duplicated code blocks: 109 repeated 6-line blocks across 22 files, notably in EditRequest.tsx and Intercept.tsx. Fix: extract shared helpers.
High — Oversized files: pkg/api/generated.go (8,109 lines), admin/src/lib/graphql/generated.tsx, pkg/api/resolvers.go. Fix: split by responsibility.
Medium — Deep nesting (13 instances), high branching density (4 files), empty catch block in AddRule.tsx.
Low — 33 TODO/FIXME markers across generated.go, filter.go, search.go, EditRequest.tsx.

SDLC findings from the CI/Docker setup: workflows lack least-privilege permissions declarations, no Dependabot config, yarn install without --immutable in CI, unpinned base images in Dockerfile, no dependency vulnerability scan, persist-credentials not disabled, and no non-root USER in the image. Tests exist (12 files) and CI runs via GitHub Actions.

The Bottom Line

A functional Burp Suite alternative with a clean Go/React split and no structural red flags. The GraphQL layer is the bottleneck — generated code dominates and will make changes expensive. Suitable for security researchers who want a self-hosted, auditable proxy tool, not for teams needing the full Burp feature set.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

168 files

Go50
TSX45
GraphQL26
TypeScript10
YAML8
Markdown5

ReactNext.jsDockerGraphQL

Module dependencies

The 10 most depended-upon modules of 56, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0__lib_components_KeyValuePair["KeyValuePair"] n1_hooks_useOpenProjectMutation["useOpenProjectMutation"] n2_ib_components_HttpStatusIcon["HttpStatusIcon"] n3_in_src_lib_graphql_generated["generated"] n4_eqlog_components_RequestLogs["RequestLogs"] n5_res_sender_components_Sender["Sender"] n6__reqlog_components_LogDetail["LogDetail"] n7__lib_components_ResponseTabs["ResponseTabs"] n8_rcept_components_EditRequest["EditRequest"] n9_ntercept_components_Requests["Requests"] n4_eqlog_components_RequestLogs --> n6__reqlog_components_LogDetail n7__lib_components_ResponseTabs --> n0__lib_components_KeyValuePair

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

medium7

low2

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/build-test.yml

2 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

yarn install without --immutable

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Pin the container base image by digestmedium3 occurrences

Dockerfile

node:${NODE_VERSION}-alpine, golang:${GO_VERSION}-alpine, alpine:${ALPINE_VERSION}

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/lint.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/build-test.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.