DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to search a source tree for secrets and dangerous calls with Xerj

Index one tree and query it for sink patterns, secrets and risky calls across every file type at once.

Authorization notice. Xerj is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Reverse engineering. Run this only on code you own or have written permission to audit, since the same searches can locate weak points in other people's software.

Who it is forA security reviewer or developer preparing an audit of a codebase they own or have written permission to test.

The problemScanning mixed files one by one with grep misses context and is slow across code, configs, logs and PDFs.

The outcomeA ranked list of matching passages with file:line that you can triage, with the search run in one indexed pass.

What you need first

  • A Linux, macOS or Windows machine on x86-64 or arm64
  • A local folder of code, docs, logs or PDFs to index
  • Claude Code or Cursor if you want the MCP and skill setup from xerj init
  • A terminal with curl and a shell

Steps

  1. xerj --insecure --data-dir ~/xerj-data &
  2. xerj autoindex ~/target-tree (inferred, check the README)
  3. xerj search "hardcoded api key" (inferred, check the README)
  4. xerj search "exec(" (inferred, check the README)
  5. Review each hit in context and record which ones are real findings.

Prompt for your agent

Index <target path> with xerj autoindex and run xerj search for secrets and dangerous-call patterns. Expected output: a table of hits with file:line and a verdict per hit. Verify each hit by opening the cited line before reporting it.

Caveat. The README lists security audits as a use, but it does not describe a built-in pattern library, so you write the queries yourself.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page