noir

Hunts every endpoint in your code to expose shadow APIs and map the attack surface, an OWASP project.

Pluginfreeglobal

noir, an OWASP project, hunts every endpoint in an application's source code to expose shadow APIs (endpoints that exist but aren't documented or tracked) and map the full attack surface, helping AppSec teams find API risk that manual documentation review would miss.

Website

Full match profile

Behind the summary, Matchbox keeps a richer profile of noir - the signals our matcher actually reads to decide when to surface it. It stays private; claim the listing to see and control it.

Problem & pain-point mapping
Who we surface it to (audience fit)
What it's a strong alternative to
Trust & credibility signals

Claim noir to unlock →

Try Matchbox with your own problem

Describe what is not working - we’ll show you whether noir (or something else) actually fits.

Try a problem