Use this reference to interpret risk levels, tags, finding types, and confidence scores. Great for entry-level red teamers learning recon.
Risk levels
Findings are classified by how sensitive or actionable the content might be.
- High
- Likely exposure of secrets or internal infrastructure: API keys, tokens, passwords, private keys, or internal IP addresses (10.x, 172.16–31.x, 192.168.x). These should be prioritized for validation and reported if confirmed. Always verify in context—some may be placeholders or test values.
- Medium
- Development or internal references: TODO/FIXME/HACK comments, debug statements (e.g.
console.log), or references to internal, dev, staging, or admin paths/endpoints. Useful for understanding workflows, unfinished security controls, or hidden features. Review to see if they reveal real attack surface.
- Low
- Generic or benign comments (e.g. copyright, license, author). Lower priority but still part of the visible attack surface; sometimes they reveal stack or tooling.
- None
- No risk pattern matched. The finding was extracted (e.g. a plain HTML comment) but didn’t match any of the high/medium/low rules. Common in “Comment extraction only” mode or for neutral content.
Tags
Tags describe why a finding was classified a certain way. One finding can have multiple tags.
#api-key / #credentials- Text matched patterns that look like API keys, tokens, or secrets (e.g. long random strings near words like “key”, “token”, “password”).
#todo- Contains TODO, FIXME, XXX, HACK, or BUG—suggests unfinished or fragile code paths.
#internal-path- References to paths or URLs that suggest internal use (e.g. /admin, /internal, /dev, /staging).
#endpoint- Looks like an API or backend endpoint (e.g. from
fetch(), apiUrl, or similar in JS).
#high-entropy- The content has high character diversity/randomness—often seen in tokens or keys. Heuristic only; can have false positives.
#generic- Matched generic comment patterns (e.g. copyright, license) and was classified as low risk.
#html-comment- Extracted from an HTML
<!-- ... --> comment in the page source.
#js-comment- Extracted from a JavaScript
// or /* */ comment in an inline script.
Finding types
Where and how the content was found.
comment- HTML comment:
<!-- ... -->. Often left in by developers; can expose stack, endpoints, or notes.
js_comment- JavaScript comment:
// or /* */. Same idea as HTML comments but inside scripts.
hidden_input<input type="hidden">. Can carry tokens, IDs, or state; check name/value for sensitivity.api_endpoint- URL or path extracted from JS (e.g. from
fetch, apiUrl, baseUrl). Direct mapping of client-visible APIs.
js_url- URL or path string found inside JavaScript. May point to assets, APIs, or internal services.
email- Email address found in the page. Useful for phishing surface or contact enumeration.
internal_path- Path-like string (e.g.
/admin, /internal) from links, forms, or JS. Good candidates for further probing.
other- Other extracted artifact that didn’t fit the above categories.
Confidence score
A 0–100 heuristic indicating how confident the classifier is that the finding matches its risk category. Higher = stronger pattern match. Use it to prioritize (e.g. high risk + high confidence first), not as a guarantee—always validate in context and mark Confirmed / False positive after review.
Status (Confirmed / False positive / Needs review)
Your assessment of the finding after manual review:
- Confirmed — You verified it’s a real, actionable finding.
- False positive — Not a real issue (e.g. test data, placeholder, or misunderstood context).
- Needs review — Not yet decided; needs more triage.