The five suites

Secret and PII exposure

The classifier sees the response before redaction. The finding stores the category and the redacted copy.

1. 01

   Let a scan capture responses

   Catalog calls, anonymous replays, and sensitive-path probes all produce bodies the classifier can read.

2. 02

   Match a category

   The categories are JSON web tokens, cloud keys, private keys, payment cards, national identifiers, password hashes, high-entropy secrets, email addresses, and stack traces.

3. 03

   Fix it in the application

   The raw secret is not in Routelint. The finding tells you the route, the identity, and the category so you can find the response that returned it.

GET /api/users
Categories   email, phone, password hash
Stored as    [REDACTED_EMAIL] · [REDACTED_PHONE] · [REDACTED_HASH]

See the redacted example