SECURITY AUDIT · OPERATIONAL

Find release weaknesses without running the release.

Upload a native binary or API contract. Cidra performs bounded, packet-free analysis, records actionable observations and discards the source bytes after the request.

Open Security Audit All product modules

EXECUTION PROFILE0 network requests0 executed bytes0 retained uploads25 MB binary cap · 10 MB API contract cap

NATIVE BINARIES

Compiler and release hardening, made visible.

The parser recognises native executable structure and reports the mitigations it can prove from bounded metadata. Presence never becomes a claim of cryptographic validity or runtime exploitability.

ASLR, DEP/NX, Control Flow Guard, high-entropy address space and bounded Authenticode structure.

ELF

PIE compatibility, non-executable GNU stack and GNU_RELRO—with full RELRO explicitly unproven.

Mach-O

PIE, non-executable heap and bounded LC_CODE_SIGNATURE data for thin binaries.

Secrets

High-confidence private-key, AWS and GitHub token signatures with redacted evidence.

Operational

What the result can establish

Release flags and structural signing data
Malformed or unsupported executable structure
Redacted high-confidence credential signatures

What it cannot establish

Malware safety or code-signing trust
Reachability of a vulnerable code path
Runtime behavior or exploitability

CCidraNorthwind / Security auditREPRESENTATIVE DEMO

NATIVE BINARY ASSURANCE

client-agent.exe

PE · x86-64 · static structure only

Operational

62/100

2 observations saved1 failed · 1 warning · 4 passed

FAILNon-executable memoryDEP / NX_COMPAT is not enabledHIGH

WARNControl-flow guardGUARD_CF is not enabledMEDIUM

PASSEmbedded code-signature dataAuthenticode data is presentINFO

Processed in memory · not executed · not retained

Representative native-binary result. Signature presence is reported separately from cryptographic trust.

API CONTRACTS

Audit the policy your API publishes.

OpenAPI 3.x and Swagger 2.0 are parsed with bounded YAML aliases and traversal. Server URLs, callbacks, examples and external references are never contacted.

Transport

Explicit HTTPS server declarations and no silently accepted cleartext production URL.

Authentication

Declared schemes, effective operation coverage, dangling references and query-string credentials.

Inventory

Stable unique operation identifiers, documented 401/403 outcomes and self-contained references.

Resource limits

Required path parameters and business-appropriate maxLength/maxItems declarations.

Packet-free

Contract evidence

Authentication and anonymous-operation declarations
Input/resource bounds and operation inventory
Legacy OAuth and query credential patterns

Runtime evidence still required

BOLA and function-level authorization
Business-flow abuse and state transitions
Rate enforcement, SSRF and injection behavior

CCidraNorthwind / API contract auditREPRESENTATIVE DEMO

API CONTRACT AUDIT

payments-api.yaml

OpenAPI 3.1 · 24 operations

Operational

Secured22operations

Anonymous2review required

External refs0nothing fetched

FAILOperation authentication coverage2 of 24 operations are anonymous in the contract.API2

WARNExplicit input bounds3 string declarations lack a maxLength.API4

INFOObject-level authorization review8 templated paths need cross-user runtime testing.API1

Representative OpenAPI result. Runtime authorization remains a separate test because a contract cannot prove BOLA or BFLA enforcement.

FINDING LIFECYCLE

The upload is temporary. The decision is durable.

Failed and warning checks become findings with the artifact hash, remediation, standard mapping and scanner identity. Clean rescans resolve only the same automated checks.

01
Role check
Lead, operator or analyst access is enforced server-side.
02
Bounded parse
Strict byte limits and no archive extraction or external fetch.
03
Redacted evidence
Credential values never enter the finding or audit event.
04
Clean rescan
Human-owned states remain untouched while regressions reopen.