Baseline-aware fuzzing from the terminal. Profile a target’s normal behaviour first, then mutate, execute and classify crashes, hangs and anomalies against that profile instead of fuzzing blindly.
The ten stages
BASELINE, profile normal exit codes, signals, runtime and output variance before fuzzing
CORPUS, persistent seed store with SHA-256 dedup, priority ordering and trimming
MUTATE, 17 structured operators driven by a seeded RNG for reproducibility
EXECUTE, process {fuzz}/{stdin} templates with no shell, HTTP payloads, or a deterministic simulation target
CLASSIFY, crash, hang, and anomaly classification relative to the baseline with sanitizer text matching
DEDUP, SHA-256 signatures collapse thousands of near-identical crashes into unique findings
FEEDBACK, novelty scoring over behavioral, edge, and block coverage keeps the campaign aimed at new code
SCHEDULE, power scheduling across fast, explore, exploit, rare, balanced, and adaptive strategies
MINIMIZE, delta-debugging reducer turns an interesting input into a minimal reproducer
REPORT, terminal, JSON or YAML with a JSONL event stream (schema_version, execution_id, framework)
Authorization guarantee
sekhmet fuzzes only the declared target. Local process targets are scoped to the declared path, remote HTTP targets require an explicit authorization acknowledgement, and --dry-run audits a campaign before anything executes. Command execution is shell-free so inputs cannot reach a shell.