Turin is a local-first intercepting proxy and DAST (dynamic application security testing) tool for API and web application security testing, built as an air-gapped standalone client.
Version 1.5.0 • Released September 1, 2026
d486f0d9c49d8e6dfd15024479532876b50bf6c0953a9926c4839cfbe250f119Features & Fixes in v1.5.0
Proxy Engine: Sub-millisecond latency intercept loops supporting WebSockets and HTTP/2 packet replay.
Local AI Copilot: Native translation of proxy streams to exploit proofs using offline models.
Offline Auditing: Completely air-gapped operations that generate encrypted report states saved locally.
Security: Upgraded cryptographic verification logic for release updates, blocking MITM vectors.
Turin is an air-gapped dynamic application security testing (DAST) client designed for security engineers, pentesters, and developers. It serves as a local-first intercepting proxy that allows users to capture, analyze, and manipulate HTTP/1.1, HTTP/2, and WebSocket traffic directly on their local host.
Built using Rust and Tauri, Turin offers sub-millisecond packet routing latencies while consuming minimal memory resources compared to traditional Java-based desktop testing suites. All capturing databases, system configuration logs, and vulnerability assessment parameters are stored locally on the host machine. Turin enforces complete network containment and includes a toggle to disable all telemetry, making it fully compliant with air-gapped corporate policies and highly restrictive internal subnets.
| Feature | Factual Technical Description |
|---|---|
| Local Intercepting Proxy | Capture and inspect HTTP/1.1, HTTP/2, and WebSocket traffic locally with on-the-fly request and response tampering. |
| Passive Vulnerability Scanning | Identify configuration flaws, missing headers, cookie security issues, and CORS leaks in real-time background streams. |
| Scriptable Payloads | Write custom Python automation scripts to query API endpoints, inject payloads, and test boundaries. |
| Air-Gapped Architecture | 100% offline operation containing zero telemetry, analytics collection, or cloud database pings. |
| CI/CD Headless Execution | Run automated, headless testing cycles integrated directly into developer build pipelines. |
| Local LLM Integration | Connect locally to Ollama instances (Llama-3, Mistral) to analyze payloads and write exploits offline. |
| Compliance Report Outputs | One-click local export templates mapped directly to SOC 2, ISO 27001, and GDPR controls. |
| Capability | Turin | Burp Suite Community | OWASP ZAP | mitmproxy |
|---|---|---|---|---|
| Deployment & Footprint | Local-first, Tauri + Rust wrapper. Minimal memory footprint. | Java VM client. High memory consumption (~2GB+ base). | Java client. Moderate memory overhead, complex interface. | Python CLI tool. Highly lightweight, command-driven console. |
| Air-Gapped Support | 100% offline. Zero tracking or remote registry calls. | Requires remote license keys and active validation checks. | 100% offline standalone execution. | 100% offline console script. |
| AI-Assisted Triage | Native integration with Ollama (Llama/Mistral) for local analysis. | Requires online extensions or SaaS API endpoints. | No native AI integration controls. | No native AI features. |
| Compliance Mapping | One-click exports mapped directly to SOC 2, ISO 27001, and GDPR. | Scoping templates require Pro/Enterprise subscription. | Standard HTML exports lacking compliance frameworks. | Command outputs require manual formatting script. |
| Scripting API | Native Python API and CLI headless configurations. | Java-based Extender API (Java, Jython, JRuby). | JavaScript, Python, Groovy, and Zest scripting engine. | Native Python scripting API. |
Linux (AppImage, deb)
macOS (ARM64, x64)
Windows (x64)
Proprietary Client
Open-Source Core Modules
Python 3.x API
Ollama (Llama-3, Mistral)
Docker & Headless CLI
GitHub Actions / CI/CD
Direct technical answers regarding deployment, licensing, and security capabilities.
Turin is free to download and use as a local-first security testing client. The core desktop engine is built on open-source libraries and supports local Python scripting, while advanced team synchronization and real-time marketplace collaboration connect natively to the XC0MRADE cloud platform.
Currently, Turin is officially distributed as a Linux AppImage and Debian package, a Windows standalone installer, and native macOS builds for both Apple Silicon (ARM64) and Intel (x64) architectures.
Unlike Burp Suite, which is a Java-based application with a heavy memory footprint, Turin is built on Tauri and Rust, providing sub-millisecond interception speeds and minimal memory overhead. Additionally, Turin features native offline AI copilot integration (via Ollama) and one-click compliance reporting tools built directly into the local desktop application.
While OWASP ZAP is an excellent open-source tool, its user interface is often complex for developers. Turin provides a modern, intuitive, and developer-friendly UX designed for fast debugging. Furthermore, Turin supports local LLM integrations and maps vulnerability signals directly to compliance frameworks like SOC 2 and GDPR.
Yes. Turin is designed to operate in completely air-gapped and offline enterprise environments. It collects zero external telemetry or analytics, and all traffic data, proxy states, and local AI queries remain completely contained on your local machine.
Turin performs passive dynamic application security testing (DAST) on live streams, scanning for injection flaws, authentication bypasses, broken object level authorization (BOLA/IDOR), CORS misconfigurations, missing security headers, and cookie posture issues.
Yes. Turin features a robust Python scripting API that allows developers to write custom payload injections, traffic manipulators, and automated scanning scripts. It also supports a headless command-line interface (CLI) mode for easy integration into CI/CD build pipelines.
Yes. Turin connects directly to local Ollama installations running on your machine. Once configured, you can use local models like Llama-3 or Mistral to analyze captured HTTP traffic, identify logical flaws, and write proof-of-concept exploits offline.
Yes. Turin generates pre-formatted dynamic reports mapping discovered vulnerabilities to SOC 2 Type II, ISO 27001, GDPR, HIPAA, NIS2, and DORA control frameworks.
Turin is designed to scale from individual security researchers to enterprise security engineering teams. Individual testers can use the standalone client, while teams can sync findings, verify reports, and collaborate via the XC0MRADE platform.
Turin is the local dynamic security testing (DAST) desktop application. XC0MRADE is the global security platform and crowdsourced security marketplace. Turin operates locally on your machine, while XC0MRADE hosts managed bug bounty campaigns, public/private VDPs, and coordinates payouts and triages.