What problem does it solve? Recovered credentials from bundles, configs, or leaks are often reported as live findings without proof, leading to rejected reports, false positives on restricted cloud keys, or accidental abuse of privileged actions outside program scope. ## Core Features & Use Cases - Three-State Verification Method: Compare responses from no credential, a bogus credential of the right shape, and the recovered credential to prove an endpoint actually validates the secret. - Gateway and mTLS Detection: Identify when a live credential is non-exploitable externally because it sits behind DataPower, F5, or Imperva gateways requiring mutual TLS. - Cloud Key Restriction Analysis: Distinguish referrer/IP restrictions from service-level blocks (e.g., API_KEY_SERVICE_BLOCKED) on Google, Firebase, and AWS keys to avoid overstated "unrestricted key" claims. - Use Case: After extracting a Google API key from a mobile app bundle, test it against StaticMap, Geocoding, and signUp endpoints to determine exactly which services are callable before writing the finding. ## Quick Start Verify whether this recovered API key is live using the three-state method and tell me exactly which restrictions apply before I report it.
