SECURITY AUDIT · OPERATIONAL
Find release weaknesses without running the release.
Upload a native binary or API contract. Cidra performs bounded, packet-free analysis, records actionable observations and discards the source bytes after the request.
NATIVE BINARIES
Compiler and release hardening, made visible.
The parser recognises native executable structure and reports the mitigations it can prove from bounded metadata. Presence never becomes a claim of cryptographic validity or runtime exploitability.
ASLR, DEP/NX, Control Flow Guard, high-entropy address space and bounded Authenticode structure.
PIE compatibility, non-executable GNU stack and GNU_RELRO—with full RELRO explicitly unproven.
PIE, non-executable heap and bounded LC_CODE_SIGNATURE data for thin binaries.
High-confidence private-key, AWS and GitHub token signatures with redacted evidence.
What the result can establish
- Release flags and structural signing data
- Malformed or unsupported executable structure
- Redacted high-confidence credential signatures
What it cannot establish
- Malware safety or code-signing trust
- Reachability of a vulnerable code path
- Runtime behavior or exploitability
client-agent.exe
PE · x86-64 · static structure only
HIGHMEDIUMINFO| Mitigation | PE | ELF | Mach-O |
|---|---|---|---|
| Address randomisationThe image can be relocated, so a fixed address is not a reliable target.CWE-119 | BIN.PE.ASLR | BIN.ELF.PIE | BIN.MACHO.PIE |
| High-entropy randomisation64-bit address space used in full rather than the low 2 GB. | BIN.PE.HIGH_ENTROPY | — | — |
| Non-executable memoryData pages cannot be executed, defeating classic stack payloads.CWE-119 | BIN.PE.DEP | BIN.ELF.NX_STACK | BIN.MACHO.NX_HEAP |
| Control-flow integrityIndirect calls are constrained to valid targets.CWE-693 | BIN.PE.CFG | — | — |
| Relocation hardeningThe relocation table is made read-only after linking.CWE-693 | — | BIN.ELF.RELRO | — |
| Full RELRORequires the dynamic BIND_NOW flag, which is not present in the section headers a bounded parse reads. | — | BIN.ELF.FULL_RELROnot provable | — |
| Code-signature structureSignature data is present and structurally bounded. Not a trust decision.CWE-494 | BIN.PE.SIGNATURE | — | BIN.MACHO.SIGNATURE |
| Universal-binary slicesEach architecture slice is enumerated so none is assessed by accident. | — | — | BIN.MACHO.UNIVERSAL |
BIN.FORMAT.MALFORMEDExecutable structureA header that does not parse is reported as unsupported, never as clean.
CWE-1104BIN.SECRET.EMBEDDEDEmbedded secretsHigh-confidence private-key, AWS and GitHub signatures, evidence redacted.
CWE-798The BIN.ELF.FULL_RELRO row is the point of the table. Full RELRO needs the dynamic BIND_NOW flag, which a bounded section-header parse does not read — so the result says so, rather than reporting partial RELRO as though it were full.
API CONTRACTS
Audit the policy your API publishes.
OpenAPI 3.x and Swagger 2.0 are parsed with bounded YAML aliases and traversal. Server URLs, callbacks, examples and external references are never contacted.
Explicit HTTPS server declarations and no silently accepted cleartext production URL.
Declared schemes, effective operation coverage, dangling references and query-string credentials.
Stable unique operation identifiers, documented 401/403 outcomes and self-contained references.
Required path parameters and business-appropriate maxLength/maxItems declarations.
Contract evidence
- Authentication and anonymous-operation declarations
- Input/resource bounds and operation inventory
- Legacy OAuth and query credential patterns
Runtime evidence still required
- BOLA and function-level authorization
- Business-flow abuse and state transitions
- Rate enforcement, SSRF and injection behavior
payments-api.yaml
OpenAPI 3.1 · 24 operations
API2API4API1Transport
1Whether the contract can be served in cleartext at all.
API.TRANSPORT.HTTPSHTTPS-only server declarationsCWE-319
Authentication and authorisation
7Which operations are reachable without credentials, and how credentials travel.
API.AUTH.SCHEMESAuthentication scheme inventoryAPI.AUTH.COVERAGEOperation authentication coverageAPI.AUTH.QUERY_KEYCredentials outside query stringsCWE-598API.AUTH.REFERENCESResolvable security requirementsAPI.AUTHZ.OBJECT_LEVEL_REVIEWObject-level authorisation reviewAPI.OAUTH.LEGACY_FLOWModern OAuth flowsAPI.RESPONSE.AUTH_ERRORSDocumented 401 and 403 outcomes
Inventory
3Whether the contract describes a surface you can actually enumerate.
API.INVENTORY.OPERATIONSAPI operation inventoryAPI.INVENTORY.OPERATION_IDStable operation identifiersAPI.REF.SELF_CONTAINEDSelf-contained contract audit
Input and resource limits
2Whether the contract bounds what a caller may send.
API.INPUT.BOUNDSExplicit input boundsCWE-20API.PARAM.PATH_REQUIREDRequired path parameters
FINDING LIFECYCLE
The upload is temporary. The decision is durable.
Failed and warning checks become findings with the artifact hash, remediation, standard mapping and scanner identity. Clean rescans resolve only the same automated checks.
- 01Role check
Lead, operator or analyst access is enforced server-side.
- 02Bounded parse
Strict byte limits and no archive extraction or external fetch.
- 03Redacted evidence
Credential values never enter the finding or audit event.
- 04Clean rescan
Human-owned states remain untouched while regressions reopen.
STANDARDS MAPPING
Every finding carries the reference it was raised under.
Procurement asks which framework a result maps to. These are the mappings the scanner itself attaches, transcribed from the check definitions rather than assembled for a datasheet.
CWE
Weakness classification on binary and API findings
CWE-20CWE-119CWE-319CWE-354CWE-494CWE-598CWE-693CWE-798CWE-1104OWASP WSTG
Web observation methodology references
WSTG-ATHN-01WSTG-CONF-07WSTG-CONF-12WSTG-CONF-14WSTG-INFO-08WSTG-SESS-02Mappings are attached to findings by the scanner itself, not added afterwards by a report generator. A check with no defensible mapping carries none, which is why the lists above are shorter than a coverage claim would be.