PAGES
← all tools
◆ Reconnaissance & OSINT

cariddi

v1.4.6 open-source

Cariddi crawls URLs from a list of domains and scans for endpoints, secrets, API keys, file extensions, and tokens.

source ↗ rss ↗ What is a cyber toolchain?

Summary

cariddi is an open-source command-line crawler that takes a list of domains and scans the URLs it finds for endpoints, secrets, API keys, tokens, and interesting file extensions. It runs as a single Go binary, installable via Homebrew, Snap, Pacman, or go install, which suits red teamers and bug bounty hunters doing recon rather than teams wanting a hosted dashboard. Its secret detection covers a wide range of providers, from AWS and Azure storage to OpenAI and Anthropic keys, and flags like -md for crawl depth and -ie to skip file extensions let it fit into CI pipelines without runaway scans. It sits in the reconnaissance space alongside other crawling and secret-scanning tools rather than replacing any single named one, and with 13 contributors and 34 commits in the past year across ten releases, it is actively maintained.

Cariddi crawls URLs from a list of domains and scans for endpoints, secrets, API keys, file extensions, and tokens.

How cariddi helps

Which of my domains are leaking API keys or cloud credentials right now?

crawls the URLs found under each domain and matches page content and responses against provider-specific patterns for AWS, Azure, GCP, OpenAI, Anthropic, and dozens of others, reporting the matched secret and the URL it was found on

What endpoints exist on this target that I never documented?

follows links discovered during the crawl and lists the distinct URLs and endpoints it reaches, giving a map of what is actually reachable rather than what is in a spec

Which pages on this site are throwing framework or database errors that reveal internals?

matches crawled responses against error-signature rules for Python, ASP.NET, and SQL Server, flagging pages that leak stack traces or technology details

Are any old backup, config, or source files still sitting exposed on this server?

flags URLs whose file extensions match interesting or sensitive types found during the crawl, surfacing files like configs or backups mixed in with normal pages

Can I run a secret-and-endpoint sweep across a target without it spiraling into an unbounded crawl in CI?

limits how many links deep the crawler follows from the initial target and skips chosen file extensions during scanning, keeping the sweep bounded for pipeline use

Did last week's crawl miss anything because a page loaded content dynamically?

expands the set of HTML selectors it inspects when parsing crawled pages, widening what counts as a discoverable endpoint or data point beyond plain links

all 7 features, with the evidence for each →

Languages

Not documented

Features

7 capabilities · 3 backed by code, an API document or a real run

Built from cariddi's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • cariddi covers 1 of the 13 network discovery and scanning capabilities we track.

What cariddi offers you

  • Command-line interface1
  • JSON data export1
All capabilities 7 capabilities
Web crawling verified Crawls a target URL up to a configurable maximum depth. 7 releases · 8 other sources · first seen Sep 2021

Shared capability: Attack surface inventory

release 7 total

  • Enhances secret detection patterns for broader coverage. v1.4.6 · Mar 2026 · source · release history
  • Adds more default file extensions to the ignored-while-scanning list, reducing noise from binary and non-text assets. v1.4.6 · Mar 2026 · source · release history
  • Adds secret detection rules for Azure Blob/ADLS Storage, Google Cloud Storage, and DigitalOcean Spaces (S3-compatible buckets). v1.4.3 · Sep 2025 · source · release history
  • Adds -md (MaxDepth) flag to limit how deep the crawler follows URLs from the initial target. v1.4.0 · Apr 2025 · source · release history
  • Adds -ie (IgnoreExtensions) flag accepting a comma-separated list of file extensions to skip during scanning. v1.4.0 · Apr 2025 · source · release history
  • Expands HTML selectors coverage for broader endpoint and data discovery. v1.4.0 · Apr 2025 · source · release history

docs

  • Crawls a list of domains and scans URLs for endpoints, secrets, API keys, file extensions, tokens, and errors.

command line

  • --md — Maximum depth level the crawler will follow from the initial target URL. v1.4.0 · Apr 2025 · command-line history

example

  • Limit crawl depth to 3 levels when scanning a large site to avoid runaway recursion in CI pipelines. echo 'https://example.com' | cariddi -md 3 -s v1.4.0 · Apr 2025 · source
  • Skip binary and media file extensions to keep scans focused on code and config endpoints. echo 'https://example.com' | cariddi -ie 'png,jpg,gif,svg,bmp,ttf,woff' -s v1.4.0 · Apr 2025 · source
  • Scan targets even when HTTPS certificates are invalid or self-signed. cariddi -u https://target.com -insecure v1.1.8 · Sep 2022 · source
  • Crawl through a proxy cat urls.txt | cariddi -proxy http://127.0.0.1:8080
  • Crawl including subdomains cat urls.txt | cariddi -intensive
  • Crawl a single target URL echo https://edoardottt.com/ | cariddi
JSON output verified Prints command output as JSON to stdout. 4 releases · 4 other sources · first seen May 2022

Also counts toward: Command-line interface, JSON data export

release

  • Optimizes secret, error, and info pattern matching using goroutines and precompiled regexes for significantly faster scans. v1.4.0 · Apr 2025 · source · release history
  • Improves HTML and TXT output performance and UI. v1.4.0 · Apr 2025 · source · release history
  • Adds --json CLI flag to enable JSON formatted output v1.3.1 · Mar 2023 · source · release history
  • Adds --debug flag to enable debug output for troubleshooting crawl issues v1.1.7 · May 2022 · source · release history

command line

example

  • Pipe machine-readable results into other tools or log aggregators cariddi --targets targets.txt --json | jq . v1.3.1 · Mar 2023 · source
  • Debug a specific domain crawl to see exactly which pages were skipped or failed. cariddi --url https://target.com --debug -o results.txt v1.1.7 · May 2022 · source
  • Output results to HTML file cat urls.txt | cariddi -oh target_name
Informational endpoint detection shipped Extracts informational endpoints and scans for hidden leaks such as debug panels or info pages using new regexes. 3 releases · 2 other sources · first seen May 2022

Shared capability: Attack surface inventory

release

  • Adds error detection rules for Python, ASP.NET, and SQL Server to surface technology-specific leakage during crawls. v1.3.6 · Apr 2025 · source · release history
  • feat: add Alibaba OSS bucket detection enables scanning for Alibaba Cloud Object Storage Service buckets v1.3.5 · Jul 2024 · source · release history
  • Adds --info flag along with new info regexes to extract informational endpoints during scanning v1.1.7 · May 2022 · source · release history

example

  • Scan for informational leaks (like debug panels or info pages) that are usually hidden. cariddi --url https://target.com --info -o info_leaks.txt v1.1.7 · May 2022 · source
  • Hunt for custom endpoints from file cat urls.txt | cariddi -e -ef endpoints_file
AWS Cognito user pool detection shipped suggested Detects AWS Cognito user pools via regex patterns. 4 releases · first seen Sep 2022

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Adds secret detection rules for OpenAI, Anthropic, GitLab, AWS Bedrock, Grafana, Heroku, Perplexity, Rubygems, and Postman API keys/tokens. v1.4.4 · Nov 2025 · source · release history
  • Adds detection for OpenAI API keys in the secrets scanner. v1.4.1 · Apr 2025 · source · release history
  • Adds secret detection rule for Facebook tokens. v1.3.6 · Apr 2025 · source · release history
  • Adds detection for AWS Cognito user pools via regex v1.1.8 · Sep 2022 · source · release history
HTTP response storage verified Stores HTTP responses captured during crawling. 1 release · 2 other sources · first seen Jun 2023

release

  • Adds -sr CLI flag to store HTTP responses captured during the crawl and scan process v1.3.2 · Jun 2023 · source · release history

command line

example

  • Capture raw HTTP responses for detailed forensics or debugging of endpoint behavior. cariddi -d example.com -sr v1.3.2 · Jun 2023 · source
Secrets detection shipped Scans URLs and endpoints for leaked secrets, API keys, tokens, and errors. 2 other sources

docs

  • Crawls a list of domains and scans URLs for endpoints, secrets, API keys, file extensions, tokens, and errors.

example

  • Hunt for secrets cat urls.txt | cariddi -s
Robots.txt bypass shipped suggested Ignores robots.txt rules to target all discovered URLs during crawling. 1 release · first seen May 2022

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Changes default behavior to ignore robots.txt rules, ensuring all discovered URLs are targeted regardless of disallow directives v1.1.7 · May 2022 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for cariddi, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail cariddi puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

14 entries

  1. March 20261
  3. November 20251
  5. September 20251
  7. April 20253
  11. July 20241
  13. June 20231
  15. March 20231
  17. September 20221
  19. May 20221
  21. October 20211
  23. September 20212

    14 entries

    1. v1.4.6 Mar 29, 2026 · release notes

      cariddi v1.4.6 expands default ignored file extensions and enhances secret detection patterns.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.6 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.6
      • Adds more default file extensions to the ignored-while-scanning list, reducing noise from binary and non-text assets.
      • Enhances secret detection patterns for broader coverage.

      2 details in Everything

    2. v1.4.4 Nov 13, 2025 · release notes

      cariddi v1.4.4 adds secret detection rules for OpenAI, Anthropic, GitLab, AWS Bedrock, Grafana, Heroku, Perplexity, Rubygems, and Postman.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.4 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.4
    3. v1.4.3 Sep 12, 2025 · release notes

      cariddi v1.4.3 adds secret detection rules for Azure Blob/ADLS Storage, Google Cloud Storage, and DigitalOcean Spaces.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.3 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.3
    4. v1.4.1 Apr 30, 2025 · release notes

      cariddi v1.4.1 adds OpenAI API key detection to its secret-scanning engine.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.1 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.1
      • Adds detection for OpenAI API keys in the secrets scanner.

      1 detail in Everything

    5. v1.4.0 Apr 14, 2025 · release notes

      cariddi v1.4.0 adds MaxDepth and IgnoreExtensions flags plus goroutine-powered pattern matching for faster secret and endpoint scanning.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.4.0 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.4.0
      └──▷ TRY IT
      Limit crawl depth to 3 levels when scanning a large site to avoid runaway recursion in CI pipelines.
      $ echo 'https://example.com' | cariddi -md 3 -s
      Skip binary and media file extensions to keep scans focused on code and config endpoints.
      $ echo 'https://example.com' | cariddi -ie 'png,jpg,gif,svg,bmp,ttf,woff' -s
      • Adds -md (MaxDepth) flag to limit how deep the crawler follows URLs from the initial target.
      • Adds -ie (IgnoreExtensions) flag accepting a comma-separated list of file extensions to skip during scanning.
      • Optimizes secret, error, and info pattern matching using goroutines and precompiled regexes for significantly faster scans.
      • Expands HTML selectors coverage for broader endpoint and data discovery.
      • Improves HTML and TXT output performance and UI.

      5 details in Everything

    6. v1.3.6 Apr 3, 2025 · release notes

      cariddi v1.3.6 adds Python, ASP.NET, and SQL Server error detections plus Facebook token secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it..

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3.6 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.3.6
      • Adds error detection rules for Python, ASP.NET, and SQL Server to surface technology-specific leakage during crawls.
      • Adds secret detection rule for Facebook tokens.

      2 details in Everything

    7. v1.3.5 Jul 1, 2024 · release notes

      Cariddi v1.3.5 adds Alibaba OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. bucket detection and updates BurpSuite integration

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3.5 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.3.5
      • feat: add Alibaba OSS bucket detection enables scanning for Alibaba Cloud Object Storage Service buckets
      • Updates the BurpSuite integration to improve compatibility with recent Burp versions

      2 details in Everything

    8. v1.3.2 Jun 9, 2023 · release notes

      cariddi v1.3.2 adds -sr flag to store raw HTTP responses during scanning

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3.2 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.3.2
      └──▷ USE IT
      Capture raw HTTP responses for detailed forensics or debugging of endpoint behavior.
      shell 
      cariddi -d example.com -sr
    9. v1.3.1 Mar 23, 2023 · release notes

      cariddi v1.3.1 adds --json flag for CLI output in JSON format

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.3.1 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.3.1
      └──▷ USE IT
      Pipe machine-readable results into other tools or log aggregators
      shell 
      cariddi --targets targets.txt --json | jq .
    10. v1.1.8 Sep 4, 2022 · release notes

      cariddi v1.1.8 adds AWS Cognito regex support and an -insecure HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. flag

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.8 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.1.8
      └──▷ USE IT
      Scan targets even when HTTPS certificates are invalid or self-signed.
      shell 
      cariddi -u https://target.com -insecure
      • Adds -insecure CLI flag to ignore invalid HTTPS certificates
      • Adds detection for AWS Cognito user pools via regex

      2 details in Everything

    11. v1.1.7 May 3, 2022 · release notes

      Cariddi v1.1.7 adds -debug, -info options and ignores robots.txt by default

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.7 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.1.7
      └──▷ USE IT
      Debug a specific domain crawl to see exactly which pages were skipped or failed.
      shell 
      cariddi --url https://target.com --debug -o results.txt
      Scan for informational leaks (like debug panels or info pages) that are usually hidden.
      shell 
      cariddi --url https://target.com --info -o info_leaks.txt
      • Adds --debug flag to enable debug output for troubleshooting crawl issues
      • Adds --info flag along with new info regexes to extract informational endpoints during scanning
      • Changes default behavior to ignore robots.txt rules, ensuring all discovered URLs are targeted regardless of disallow directives

      3 details in Everything

    12. v1.1.1 Oct 5, 2021 · release notes

      Adds make update CLI command and new URL crawling targets (form action/event, XML sitemaps)

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.1 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.1.1
      • Adds the make update command that updates everything
      • Added event on action attribute of form tag (url crawling)
      • Added event on xml sitemaps (url crawling)

      3 details in Everything

    13. v1.1 Sep 28, 2021 · release notes

      cariddi v1.1 adds form action event hooks, custom user agent generation, and sitemap XML parsing.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.1
      • Adds onXML event to catch sitemaps
      • Adds user agent creation to avoid the colly default one
      • Adds event on action attribute of form HTML tag

      3 details in Everything

    14. v1.0 Sep 27, 2021 · release notes

      First release of cariddi: a CLI tool to crawl domains and scan for endpoints, secrets, API keys, and tokens.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0 https://github.com/edoardottt/cariddi.git
# already have the repo? check out this version:
$ git checkout v1.0

    Project health

    Issue, contributor and maintainer activity in edoardottt/cariddi, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −2 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close < 1 day first maintainer reply 7.2 hours
    6. Open backlog 8 of 79 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 8
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 3,772
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback