SwaggerSpy

SwaggerSpy is a Python tool that automates OSINT against SwaggerHub, scanning published API documentation for secrets and credentials that developers left in it by mistake. You give it a search term; it pulls the matching API definitions from SwaggerHub and runs regular expressions over them looking for exposed keys, tokens, and other sensitive strings.

T3 — a first-party project repo with self-reported capabilities, matching how this spoke tiers llm-osint and kallisto-osinter. Tier was missing entirely until the 2026-07-28 quality cycle.

What it targets

[[osint#the-classic-toolkit|SwaggerHub]] is a collaborative platform for designing, building, and managing APIs with the Swagger/OpenAPI framework — a public, searchable corpus of API definitions. Because those definitions describe real endpoints, they routinely carry example requests, auth headers, and hardcoded credentials that were never meant to be public. SwaggerSpy treats that corpus as a recon surface: it fetches API docs and pattern-matches for the secrets inside them.

How it works

Source: obtains API documentation from SwaggerHub for a given search term.
Detection: inspects that documentation with regular expressions to flag sensitive information (secrets, credentials).
Tech: 100% Python; dependencies in requirements.txt. Regex pattern-matching is the whole engine — no LLM/agents (a deliberate contrast with the ai-osint tools here).

git clone https://github.com/UndeadSec/SwaggerSpy.git
cd SwaggerSpy
pip install -r requirements.txt
python swaggerspy.py searchterm

Where it sits

SwaggerSpy is a narrow, single-source recon tool in the classic osint vein — automate one slice of finding public data — but pointed at machine secrets, not at profiling a person. That sets it apart from the founding corpus: llm-osint and kallisto-osinter build profiles of people; SwaggerSpy harvests leaked credentials from a specific platform. It is the spoke’s first secrets-exposure / attack-surface tool — closer to Shodan-class infrastructure recon than to the person-lookup pole. See synthesis for how it widens the spoke past the AI-OSINT + social- engineering axis toward general offensive-security recon.

Dual-use

Same public-data-aggregation tension the spoke carries throughout, but sharper: the “sensitive information” SwaggerSpy surfaces is live credentials. For a defender or an authorized pentester it is a leak-detection sweep of an org’s own published APIs; the identical run is a credential- harvesting tool for an attacker. Documented here for defensive/educational/research use — see the ethics stance in synthesis and CLAUDE.md.

Provenance

Author: Alisson Moretto (UndeadSec), a cyber-threat-intelligence professional (repo README).
License: MIT. Language: Python (100%). Star count / activity are volatile — treat as a snapshot (fetched 2026-07-02).

osint · ai-osint · kafsiem · social-engineering · synthesis