Find what your app is leaking — before someone else does.
Cairn scans your deployed app's surface for exposure — secrets shipped in client bundles, exposed files, source maps, and admin endpoints — re-verifies each finding, and files the high-severity ones.
It scans the surface attackers check first.
Cairn fetches your client bundles and probes your deployed app for leaked secrets, exposed files, and source maps — then re-verifies each finding.
Server API key shipped to the browser
Your worst exposures are the ones you ship by accident.
A server-side API key bundled into the JavaScript you ship to browsers. A .env file left reachable in production. A source map that hands an attacker your entire source. An admin route that forgot its auth. None of these are logic bugs — they're exposure, sitting in plain sight on your public surface.
Functional tests never look for them, because everything still “works.” The secret in the bundle works fine — for anyone who reads it. These are exactly the issues a green test suite sails past and a stranger with browser dev tools finds in minutes.
Cairn scans for them continuously, against your real deployed app, and verifies each finding before it reports it— so you hear about the leak from a machine on your side, not from someone who shouldn't have found it.
Fetch, scan, verify, file.
A bounded, rate-limited scan of your own app's surface — informed by what's actually in your repo.
Probes the surface
Cairn requests the paths attackers check first — .env and config files, .git directories, backups, source maps, and admin or internal endpoints — using a list informed by your repo's framework.
Reads your client bundles
It fetches the JavaScript your app ships to the browser and scans it for known secret formats — API keys and tokens that were never meant to leave the server.
Grades and verifies
Findings are graded by real severity — a publishable Firebase web key isn't a leaked server key — and re-verified by re-fetching, so what surfaces is real, not a transient 200 or a single-page-app catch-all.
Files what matters
High-severity findings are filed to your GitHub as deduplicated issues, and every scan produces a shareable HTML report.
The high-impact, low-effort exposures.
Not a full pentest — focused, reliable coverage of the leaks and exposed surface that hurt the most.
Secrets in your client bundle
Cairn scans the JS you ship to browsers for leaked API keys and tokens — with severity grading that knows a Firebase web key from a real server secret.
Exposed files and surface
Reachable .env and config, .git directories, backups, published source maps, and admin endpoints — the exposures attackers probe for first.
Verified, then filed
Every finding is re-checked before it's reported, and high-severity ones land in your tracker as deduplicated issues with a report attached.
The scan runs against the same environment as your functional suite, on demand — so the secrets and surface you accidentally ship get caught by a machine on your side.
Frequently asked questions
Exposure on your deployed app's surface: secrets leaked in client-side JavaScript bundles, exposed files (.env, .git, backups), published source maps, and reachable admin or internal endpoints.
It fetches the JavaScript your app ships to the browser and scans it for known secret formats — API keys and tokens that should never leave the server. It grades severity intelligently, so a publishable Firebase web key isn't treated like a leaked server-side key.
Cairn re-verifies a finding before reporting it — re-fetching the path to confirm it still resolves — and suppresses single-page-app catch-all responses, so an exposed-file finding means the file is genuinely reachable.
Findings appear in the dashboard with a severity, high-severity ones are filed to your GitHub as deduplicated issues, and every scan produces an HTML report you can share.
The deployed environment you've configured for the connected repo — the same setup your functional tests use. The scan is a bounded, rate-limited probe of your own app's surface, and you choose when it runs.
Not today. The current scan focuses on exposure and leaked secrets — the highest-impact issues that are also reliably detectable. Deeper application probes such as access-control (IDOR) testing are on the roadmap, not part of the scan yet.
Explore more of Cairn
Put your tests on autopilot.
Connect a repo and watch Cairn map your flows, write the tests, and run them on every PR — in minutes.