Source intelligence that maps what your spec forgot.
Source intelligence is how NightVision does API discovery: it reads your code before the scan and maps the API routes your frameworks declare. API eNVy™ reads supported source locally and emits an OpenAPI spec in under 20 seconds.
You can't secure APIs you don't know exist.
Endpoints ship from every corner of the business; the ones never onboarded stay invisible while the dashboard stays green. Source intelligence closes that gap and feeds the routes into whole-app DAST. Hunting for routes nobody documented? See shadow API detection; building a record for audit? See API inventory. Mapping an app before a pentest? See pentester acceleration.
| Source-based NightVision API eNVy™ | Traffic-based observability tools | Spec-driven scanners | |
|---|---|---|---|
| Finds undocumented & shadow APIs | ✅ Yes, from code | ⚠️ Only after traffic | ❌ Only what the spec lists |
| Works before code ships (in CI) | ✅ Pre-production | ❌ Needs production traffic | ⚠️ Only if the spec is current |
| Needs a running app or traffic | ✅ No | ❌ Yes | ✅ No |
| Needs an existing OpenAPI spec | ✅ No, it generates one | ✅ No | ❌ Yes |
| Time to generated inventory | ✅ Seconds on supported codebases | ❌ Depends on traffic | ⚠️ Depends on maintenance |
| Source & data exposure | ✅ Stays local; no LLM in spec generation | ❌ Traffic (tokens, PII) flows through the tool | ✅ Not applicable |
From repo to tested API surface in three steps.
1. Point at your code
Connect a repo or run the CLI against your source tree. No running app, no agents, no code changes.
2. Get the spec in <20 seconds
On supported codebases, API eNVy™ reads the routes your frameworks declare, their parameters, response shapes, and the authentication scheme protecting each endpoint, then writes an OpenAPI/Swagger spec.
3. Add routes to DAST
The generated spec feeds dynamic testing, with HTTP evidence on request-level findings and Code Traceback on supported ones. How source-linked DAST works.
REST API discovery across supported backend frameworks.
Support is claimed per framework, not per language, and every framework below is empirically verified.
Beyond routes: each endpoint is tagged public or protected and mapped to its security scheme (bearer, basic, API key, or OAuth2), with required roles on Java frameworks.
Source intelligence covers REST APIs; other styles need a supported spec or recorded traffic. See the full support matrix in the docs.
Deterministic, local, and private by design.
Spec generation reads how your frameworks declare their routes: no LLM reads your code, and the same code yields the same spec. That map is how the API scan learns what to test.
Your code never leaves your environment
The engine runs locally, as a CLI or inside CI, and source code is never uploaded. Generated files go to NightVision by default; add --no-upload to keep them on your machine.
Deterministic, not probabilistic
Like a compiler: supported constructs produce repeatable output every run.
No running app, no traffic, no agents
Point it at a supported repository and generate an OpenAPI inventory in seconds.
Source context where supported
On supported source-intelligence API scans, Code Traceback connects a dynamic finding to the defining file and line.
Comparing API security testing tools? See NightVision vs Bright Security and NightVision vs Escape, or browse all DAST comparisons.
More than a route map.
The same source intelligence run can report three more things, each written beside the generated spec, and it accounts for what it read.
Routes that call a language model
Routes that reach an LLM SDK, such as OpenAI, Anthropic, Google, Bedrock or LangChain, are marked in the spec across Python, C#, Go, JavaScript, TypeScript, Ruby and PHP, so you know where your AI endpoints are.
Quantum-vulnerable and weak cryptography
With --weak-crypto: RSA and elliptic-curve use, broken hashes and ciphers, and verification turned off, in Python code and in committed keys, certificates and TLS configuration, each with a fix and NIST's dates. See quantum readiness.
Hardcoded credentials
With --credentials: secrets written into Python code where JWT, database, HTTP and AWS calls take them, and committed .env files, private keys, .npmrc, .netrc and AWS credentials files. The report is redacted and never holds the secret. How hardcoded credential detection works.
A clear account of every run
Each run names the roots it scanned, the files it read per language, the frameworks it recognized and anything it could not read, so a short spec is never mistaken for a complete one.
Cryptography and credential reports run in the NightVision CLI today. Viewing them in the NightVision platform is in development.
API discovery tool questions, answered.
What is API discovery?
The process of finding and inventorying API endpoints in your applications, including undocumented, shadow, and legacy routes missing from maintained OpenAPI specs, so dynamic testing gets a broader target inventory.
How does NightVision generate an OpenAPI spec from source code?
API eNVy™ reads supported source to identify recognized routes, parameters, response shapes, and the authentication scheme protecting each endpoint, then emits an OpenAPI (Swagger) spec in under 20 seconds, with no running app, traffic capture, or code changes.
Does API eNVy™ detect authentication and security schemes?
Yes. On supported frameworks, API eNVy™ reads each framework's native authentication patterns (guards, middleware, filters, and security annotations) and records them in the generated spec: every endpoint is marked public or protected, tagged with the scheme that guards it (bearer, basic, API key, or OAuth2), and Java endpoints also carry the roles they require. That tells DAST exactly where to authenticate and which exposed routes to hit first. See the framework support and limitations in the docs.
Does NightVision upload my source code?
No. Source intelligence runs locally as a CLI or in your CI pipeline, with no LLM reading your code, and your source code is never uploaded. By default the generated spec and a run summary are sent to NightVision; add --no-upload to send nothing.
Can source intelligence find quantum-vulnerable cryptography?
Yes. With --weak-crypto, the NightVision CLI reports RSA, DSA, Diffie-Hellman and elliptic-curve use, plus cryptography that is already weak, in Python code and in committed keys, certificates, TLS configuration and dependencies in any language. Each finding names a fix and NIST's deprecation dates. Viewing these findings in the NightVision platform is in development. Quantum readiness.
Does source intelligence find hardcoded secrets?
Yes. With --credentials, it reports credentials written into Python code where JWT, database, HTTP and AWS calls take them, and committed .env files, private keys, .npmrc, .netrc and AWS credentials files in any language. The report never contains the secret itself.
Source intelligence is step one of the NightVision loop: it studies the app, the scan runs the plan, and remediation and learning close the loop in your code. See the loop →
Background reading: API discovery and shadow APIs in application security testing.
Your spec is 20 seconds away.
Run API eNVy™ against one of your repos, free, no credit card, and count the endpoints you didn't know you had.