What we detect
Detection coverage
Review the available categories below, then check each report for the stages that completed. Network references are static findings; new scans do not test current backend reachability.
Cloud storage & database references
Static referencesAmazon S3Google Cloud StorageFirebase Realtime DatabaseFirebase StorageCloud FirestoreDigitalOcean Spaces
Cloud & platform keys
AWS access keysGCP service accountsAzure Storage keysGoogle API keysGoogle OAuth secretsFirebase FCM keys
Payment secrets
Stripe live / restricted keysStripe webhook secretsSquare tokensBraintree / PayPal tokens
AI / LLM keys
OpenAIAnthropicHugging FaceGroqReplicatePerplexity
Dev & supply-chain tokens
GitHub PATGitLab PATnpmPyPIDigitalOcean PATLinearNotion
Comms & email
Slack tokens & webhooksDiscord bot tokens & webhooksTelegram bot tokensTwilioSendGridMailgun
Databases & private keys
Postgres / MySQL / MongoDB / Redis URIsPEM private keysCloudinary credentials
Crypto wallets
Checksum-validatedBIP39 seed phrases (12–24 words, checksum-verified)
Trackers & SDKs
Privacy signalRecognizable analytics, advertising, attribution & crash SDKs
App integrity: signing
Debug certificateWeak signature algorithm (SHA-1/MD5)Short RSA keyExpired certificatev1-only (Janus)
Manifest & config risks
Debuggable buildCleartext (HTTP) trafficExported providers w/o permissionBackup-enabledOutdated target SDK
Privacy indicators
Sensitive-permission accessPersistent-identifier APIsMapped to third-party SDKs present
Supply chain: SBOM & CVEs
Bundled component versions (SBOM)Known-vulnerable versions matched to advisories
How we report every finding
Detections with context. Severity reflects the recorded finding class. Static references do not prove public access or runtime behavior. Historical verification, where present, applies only to the recorded scan time.
Redacted & metadata-only. A detected secret is shown as its public scheme prefix plus a length bucket (e.g.
AKIA••••••••) — never the random body — plus a non-reversible fingerprint. We never store your raw secret on the public path.Signed Proof Capsule. Every result can be exported as a tamper-evident, independently verifiable record.