OWASP Noir
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Noir started as a WhiteBox testing aid: extract endpoints from source so DAST can scan them more accurately. The job has grown — the same inventory now feeds human auditors and AI SAST agents too. The goal from here is to serve all three consumers equally well: humans reviewing the code, LLMs auditing it, and DAST tools scanning it.
From here:
Broaden language and framework coverage; keep accuracy honest with per-framework fixtures.
Lean harder on LLMs for the cases static analysis can't reach.
Enrich the per-endpoint review context (guards, callees, sinks, validators, signals) so human reviewers and AI auditors share the same focused view of each handler.
Keep DAST integration first-class — OpenAPI, proxy targets, and direct hand-offs to ZAP / Burp / Caido / Gori.
Slack