Security Mode

Scan captured traffic for leaked secrets, PII, and threats.

Security Mode passively scans your captured traffic against 98 built-in rules (including three threat-intel rules) and surfaces findings in a dashboard with severity and confidence scoring. Turn it on with Tools → Toggle Security Mode (⌘⇧Y) and open the dashboard with Tools → Security Dashboard (⌘⌥⇧S).

What it detects

• Credentials: 30 rules (API keys, tokens, cloud keys, database URLs, private keys) via prefix + regex + Shannon-entropy validation.
• PII, insecure headers, C2/beaconing patterns, privacy/tracking, content issues, session/anomaly/supply-chain, and WebSocket-specific rules.

Custom rules

Add your own rules in the rule editor (Tools → Security Rules…), or import a subset of Sigma rules. Threat-intel rules match known-bad domains, IPs and URLs from abuse.ch feeds, held in a Bloom filter; downloading the feeds is a separate opt-in in Settings → Tools.

Privacy

Security Mode is off by default and asks for consent the first time you turn it on (PRO). Evidence is sanitized (secrets redacted), alerts last for the current session only, and nothing about your traffic is sent anywhere.