Patrick Ivanuell Firstyanto

Hi everyone, I’m Patrick, a CS student in Indonesia who also runs a few small game websites and VPS servers. I built VoidSpider, a passive security audit scanner for websites and local files you own.

How it works: a Node.js server scans one target continuously and streams results over SSE to a fullscreen dashboard. Each page or file becomes a node cluster, and a geometric spider reaches out to whatever is being scanned right now. Findings get a severity level, a fix suggestion, and an A–F score.

What it checks

Websites: security headers (CSP, HSTS, cookies), exposed files like /.env and /.git/config, leaked keys in HTML/JS, TLS configuration, SPF/DMARC/DNSSEC, and subdomain takeover risk.
Local files: hardcoded secrets, risky code patterns, webshell and obfuscation rules (YARA-style, extendable via JSON), dependency CVEs via OSV.dev, secrets in git history, Dockerfile/Kubernetes/Terraform misconfigs, and invisible-Unicode prompt injection.
Extras: drift detection against a baseline, Telegram alerts, SSH/honeypot log ingestion, SARIF output for CI, and an optional triage agent using Claude that only sees redacted snippets.

A deliberate design choice: it never sends attack payloads, never tries to log in, and never port-scans. Everything is passive GET requests, and it needs an --saya-pemilik-situs (“I own this site”) flag for remote targets. A scanner that can attack works just as well against anyone else’s site. For active testing I added an optional OWASP ZAP integration that you run yourself, with a double confirmation flag.

Honest limitations: it’s pattern-based, so expect false positives and misses. SPAs are only read as far as their initial HTML, and it’s not a replacement for a full SAST or pentest.

Where I’d love feedback:

What passive checks am I missing that you’d want in a first-pass audit? For the entropy-based generic secret detection, how would you reduce false positives further? Is the “passive only” boundary the right call, or too limiting?

Repo (MIT): github.com/patrickivanuellf/VoidSpider

Hi everyone, I’m Patrick, a Computer Science student in Semarang, Indonesia. I’ve been running my own online business since 2023, and lately I’ve been building EcoTwin AI.

The problem: AI data centers use a lot of power and water, and in Indonesia operators also have to deal with environmental permitting (AMDAL). Monitoring, workload scheduling and compliance reporting usually live in separate systems.

What EcoTwin AI does: it puts three things in one platform.

Carbon-aware orchestration: real-time inference gets priority, and batch training is deferred when grid carbon intensity is high.
Browser-based 3D digital twin: racks, thermal status and operational state, with no enterprise license needed.
Compliance metrics: PUE, WUE and CUE tracking with time-stamped, audit-friendly logs.

It’s tuned for Indonesian conditions, such as geothermal baseload and variable tropical solar.

Where it stands today: the core engine (carbon analyzer, orchestrator, metrics, compliance logger) works, and there’s a 3D dashboard prototype you can open in a browser with no setup. The grid and sensor data is still simulated. Next on the roadmap are live PLN/renewable-energy data, real facility sensors, and a multi-tenant backend.

Where I’d love feedback:

Is carbon-aware scheduling realistic for data centers in Indonesia, given how the grid is structured? If you’ve worked with data center monitoring, which metrics beyond PUE/WUE/CUE matter most? What’s the best way to get real grid data in Indonesia?

Repo: github.com/patrickivanuellf/EcoTwin-AI