About

Overview

surisc is a memory-resident reconnaissance tool written in Go. It scrapes, parses, and analyzes JavaScript bundles from target URLs, hunting for leaked API keys, hardcoded credentials, and exposed environment variables — all without writing a single byte to disk. It also audits frontend security posture by inspecting CSP, CORS, cookies, response headers, and client-side storage for misconfigurations and exposed secrets.

Designed for security researchers and penetration testers, surisc operates entirely in RAM using the colly web scraping framework. This approach leaves no forensic traces on the scanning machine and enables rapid, concurrent analysis of multiple JavaScript assets.

Key concepts

• Gravity Score A 0–10 confidence rating that indicates how likely a detected string is a real secret. 10 means high confidence (e.g. a valid AWS key).
• Shannon Entropy A mathematical measure of randomness. High-entropy strings like API keys look random; regular words do not. This helps reduce false positives.
• Leak Type The classification of a detected secret, e.g. GOOGLE_API_KEY or STRIPE_SECRET_KEY.
• Source URL The exact URL where the leaked secret was found.
• Snippet A preview of the leaked code, saving you from manually inspecting large bundles.

Design

surisc is built for speed and stealth. Its concurrent engine uses goroutines and sync.WaitGroup to process multiple JavaScript bundles in parallel. False positive filters automatically ignore common frontend compilation artifacts such as Base64 dictionaries, WebAssembly module headers, and React validation warnings.