BinarySight

Who it's for

Small security teams, bug-bounty hunters, DevOps/CI engineers who today use ad-hoc combos of strings/objdump/gdb/strace/sandbox VMs or expensive reverse-engineering firms to inspect unknown binaries.

The problem

Time and risk: manual reverse-engineering takes hours-to-days and can miss transient behaviors (time) and exposes teams to accidental execution risks (legal/regulatory risk if binaries phone home), plus expensive consultant bills (payment).

How to build it

Web upload + lightweight CLI uploader; returns a downloadable ZIP with (1) indexed JSON of symbols/strings/metadata, (2) a recorded 30s sandboxed syscall/network trace (.har + gz), and (3) a one-page HTML/PDF summary with linkable anchors; optional GitHub Action that runs on new release artifacts and posts the 1-page bundle as a check.

How it makes money

Who pays: small security teams/consultancies and mid-market dev teams; Pricing: $5–15 per scan (pay-per-scan) or $30–80/month team plan with 100 scans/mo; why pay: replaces a manual 1–4h triage or a $200+ consultant call with an automated, auditable bundle; why not free: running sandboxed dynamic traces and maintaining secure ephemeral infrastructure has real per-job cost and corporations need audit PDFs and retention (not acceptable from a free anonymous upload service).

Why it doesn't exist yet

Incumbent reverse-engineering tools are powerful but heavyweight (Ghidra, IDA) and aimed at deep manual work; CI/security teams need fast, auditable snapshots, but platform vendors avoid executing arbitrary uploaded binaries at scale due to abuse and sandboxing cost. An indie can build a narrow, automated snapshot pipeline (short, constrained run in ephemeral sandbox + passive analysis) that incumbents skip because it's lower-margin and operationally fiddly.

First users

1) bug-bounty teams want quick triage for reporter submissions; 2) small security consultancies want fast pre-engagement reports; 3) open-source maintainers want to vet third-party release artifacts; 4) packagers publishing nightly builds will link checks; 5) CI teams will add the GitHub Action for noisy PRs; the offering is cheap, prevents costly manual RE hours, and produces audit-ready artifacts to share with stakeholders.

Build size

2 people x 10 weeks: includes a secure sandbox runner (containerization + network emulation + egress controls), static analyzers (symbol extraction, PE/ELF/Mach-O parsers), a 30s dynamic tracer that records syscalls/network/files, web UI for uploads/results, and a simple GitHub Action integration. Excludes deep decompilation, signature-based malware removal, and long-running behavioral emulation (>30s).

Biggest risk

A major platform (e.g., GitHub, Snyk, or VirusTotal) launches a rival automated binary-snapshot service with free scans integrated into release workflows, or a cloud provider releases sanctioned low-cost sandboxed execution API that commoditizes the core infra costs.

Conditions for a hit (all 3 required)

• Exported symbols and typed metadata JSON for an uploaded binary within 60s (fields: filename, arch, exports list, imported libs, compile-time timestamps).
• A recorded 30-second sandboxed trace (syscall sequence + file/network events) saved as a verifiable HAR-like .gz that shows up to 10 unique outbound hostnames and file writes, produced within 3 minutes of upload.
• A 200‑word human-readable behavior summary (plain text + PDF) that cites exact trace lines or symbol names (with timestamps) and includes a risk score 0–10; all artifacts downloadable as a single ZIP.

How it's judged (in 6 months)

measurable source: 1) GitHub repo for the project reaches 1,000 stars OR 2) Product Hunt launch reaches 'Top 5 Product of the Day' on its launch day OR 3) At least three paying customer teams listed on the site with public case studies (each paying >= $30/mo) by that date (any one qualifies).(judgment date 2027-02-27)

AI self-confidence 55/100 — self-reported likelihood of meeting the criterion, not a business success rate