Your scanner finally
knows what you're
coding

Morphex brings source context, redacted evidence, and explicit policy decisions together. Trace a finding from the code that produced it to the action you take next.

EXPLORE MORPHEX

SCAN YOUR CODE. KEEP THE EVIDENCE.

FILES

DIRECTORIES

GIT HISTORY

STANDARD INPUT

JSON

SARIF

INSTALLATION

# From your authorized source checkout

$ make build

# Collect redacted evidence offline

$ ./morphex scan --json .

# Open your connected workspace

CAPABILITIES

See It In Action

Illustrative animations show extraction, context, and policy review. These demonstrations do not run scans or display live backend measurements.

The Alert Avalanche.

This simulated scan shows how contextual evidence can support a policy decision. Every row here is illustrative.

CANDIDATE EXTRACTION

Demo: 6 candidate observations.

MORPHEX PROVENANCE PASS

Awaiting context analysis...

func parseConfig() error { file, err := os.Open("config.json") if err != nil { log.Fatal(err) } defer file.Close() // ... reading raw bytes decoder := json.NewDecoder(file) err = decoder.Decode(&conf) return err } func getTestToken() string { // Never use in prod return "test_123_abc" }

[CRITICAL] Secret Exposed

tests/auth_mock.json:42

sk_test_4eC39HqLyjWDarjtT1zdp7dc

SUPPRESSED: Test Fixture

[CRITICAL] Secret Exposed

README.md:118

ghp_ABCDEFghijklmnop1234567890

SUPPRESSED: Documentation Example

[CRITICAL] Secret Exposed

src/utils/crypto.ts:15

const AES_IV_TOKEN

SUPPRESSED: Crypto Constant

[CRITICAL] Secret Exposed

config/default.js:8

dummy_password_123

SUPPRESSED: Placeholder Value

[CRITICAL] Secret Exposed

scripts/setup.sh:22

export AWS_ACCESS_KEY_ID=xxx

SUPPRESSED: Template Variable

[CRITICAL] Secret Exposed

src/api/stripe.go:84

sk_live_8f3d9a2b...

SUPPRESSED: Reportable Candidate

REPORTABLE

Deep Obfuscation Detection

Inspect supported encoded values and bounded local Go constant composition before classification. The illustration shows the idea; language and expression coverage have explicit limits.

String Concatenation
Bounded Go Composition
Base64 and Hex
Archive Inspection

# String concatenation
prefix = "sk_live_"
key = prefix + "4eC39HqLyjWDarjtT1zdp7dc"

# Variable interpolation
base = "ghp_"
token = f"{base}ABCDEFghijklmnop1234567890"

# Reversed string
secret = "cd7pdz1TjraDjWyL9qH3Ce4_evil_ks"[::-1]

HOVER TO DECODE

# [MORPHEX: CONCATENATION RESOLVED]
prefix = "sk_live_"
sk_live_4eC39HqLyjWDarjtT1zdp7dc

# [MORPHEX: INTERPOLATION RESOLVED]
base = "ghp_"
ghp_ABCDEFghijklmnop1234567890

# [MORPHEX: REVERSAL DECODED]
sk_live_4eC3Hq9LyjWDarjt1zdp7dc

SIMULATED FEED

FILES: 27,481DEMO RATE: 0.02%

The Noise Matrix

A simulated view of candidates moving through context and policy. Suppressed observations remain available in the evidence capsule.

sk_test_4eC39HqLyj

ghp_ABCDEFghijkl

const API_KEY =

xoxb-1234567890-

password123

secret_token

AWS_ACCESS_KEY

AKIAIOSFODNN7E

eyJhbGciOiJIUzI1

Bearer eyJhbGci

sk_live_8f3d9a...

sk_live_xxxxxxxx

client_secret

oauth_token

private_key

BEGIN RSA PRIVATE

test_secret_key

mock_password

POLICY SUPPRESSED

CANDIDATE REPORTED

SIMULATED METRICS

COMPUTE LOAD0.0%

AVG LATENCY22.00ms

MEMORY0MB

THROUGHPUT0 ops/s

DEMO UPTIME: 99.97%ILLUSTRATION

ARCHITECTURE

The Provenance Pipeline

Follow extraction, contextual classification, policy assessment, and evidence capture. Authentication observations stay separate from classification.

password123

AKIAIOSFODNN7E

eyJhbGciOiJIUzI1

dummy_token

[RAW_TOKEN]

sk_live_4eC39HqLyj...

tests/mock_key.json

1. EXTRACTION

Extracts candidate values; bounded decoding can recover supported forms.

prefix = "sk_live_"
key = prefix + "4eC3..."

sk_live_4eC39HqLyj...

2. SYNAPSE

Evaluates contextual signals to determine classification confidence.

Entropy: 0.998

Context: Valid

Role: API Key

3. POLICY

Applies explicit reporting and blocking rules while retaining observations.

Demo: suppressed observations

Demo: reportable candidate

4. EVIDENCE

Captures redacted observations and receipts for offline replay and comparison.

evidence.json

EVIDENCE

A Finding You Can Inspect

Keep the observations, coverage, and policy behind each decision. Revisit the evidence without rescanning your source.

SCAN INPUTS

Files · directories · stdin · Git history

EXPORT FORMATS

JSON evidence · SARIF findings

REDACTION LEVEL

Raw secret values stay out of exports

ILLUSTRATIVE SCAN FLOW

SIMULATED OUTPUT

COLLECT (DEMO)FILES: 0SUPPRESSED: 0

ASSESS (DEMO)FILES: 0OBSERVATIONS: 0

RETAIN (DEMO)FILES: 0OBSERVATIONS: 0

Your scanner finallyknows what you'recoding

See It In Action

The Alert Avalanche.

Deep Obfuscation Detection

The Noise Matrix

The Provenance Pipeline

1. EXTRACTION

2. SYNAPSE

3. POLICY

4. EVIDENCE

A Finding You Can Inspect

ILLUSTRATIVE SCAN FLOW

Your scanner finally
knows what you're
coding