Features · surisc

Secret detection

AWS Access KeysAKIA-prefixed keys

Stripe Secret Keyssk_live_ prefixed keys

GitHub Tokensghp_ personal access tokens

GitLab Tokensglpat- prefixed tokens

Google API KeysAIza-prefixed keys (GCP, Maps, Firebase)

Slack Tokensxoxb- bot tokens

Cloudflare CredentialsGlobal API keys and tokens

Mail Service KeysSendGrid, Mailgun, Resend

Payment TokensSquare, Twilio

RSA Private Keys-----BEGIN PRIVATE KEY----- headers

Bearer TokensAuthorization bearer tokens

Internal IPs10.x, 172.16.x, 192.168.x ranges

Env Leaksimport.meta.env.* build-time leaks

Generic SecretsVariable assignments like API_KEY:"value"

Map FilesExposed .map dependency files

Firebase Config LeakfirebaseConfig/initializeApp with exposed apiKey

Supabase Config LeaksupabaseUrl/supabaseKey variable assignments

Source Map IngestionRecursively scans .map file original sources for secrets

Client-side Storage TokensScans localStorage, sessionStorage, IndexedDB references for stored secrets

Response Header API KeysScans HTTP response headers for exposed API keys and secrets

SPA DetectionIdentifies single-page application frameworks

Security HeadersCSP, X-Frame-Options, HSTS, CORS checks

Cookie HardeningHttpOnly, Secure, SameSite flags

JWT DetectionIndicators from cookie names and values

Route DiscoveryExtracts routes from HTML, JS, JSON, robots.txt, sitemap.xml

Attack-surface ProbingCommon paths: /admin, /api, /auth, /dashboard, /graphql

API Spec DiscoveryProbes 10 paths for OpenAPI/Swagger specs and detects references in JS bundles

GraphQL IntrospectionQueries /graphql endpoints for enabled introspection

Frontend Security AuditCSP, CORS, SRI, XSS, open redirect, insecure forms, vulnerable CDN

State Management DetectionIdentifies Redux, Zustand, Pinia, Vuex, and other client-side state libs

Memory-ResidentOperates entirely in RAM. No temp files written to disk.

ConcurrentGoroutine-based engine processes multiple bundles in parallel.

Entropy AnalysisShannon entropy scoring to flag high-randomness strings.

False Positive FilteringIgnores Base64 dicts, WASM headers, React warnings.