Part 1 of a 3-part series on open-source security tooling worth knowing: AppSec tooling in Go, Firebase recon, and AI agents in pentesting.

If you've been in application security for more than a few years, you've lived through the era of running 20 different Python scripts, juggling broken pip dependencies, and waiting 45 minutes for a single-threaded scanner to finish.

That era is fading fast. A big part of the offensive security and bug bounty toolbox is now written in Go : dalfox , katana , httpx , subfinder , nuclei , ffuf . There are good reasons for that:

No dependency hell. One compiled binary. Copy it and run it.

Cheap concurrency. Goroutines make thousands of parallel requests the default, not a hack.

Unix-pipe friendly. Small tools that read and write plain text chain naturally: cat urls.txt | tool1 | tool2 .

Two open-source projects show where this is heading.

1.…