Your scanner finally
knows what you're
coding
Morphex turns your CI/CD into a provenance engine that knows the difference between a test fixture, a documentation example, and an active production key.
# macOS / Linux
$ brew install pkmdev-sec/tap/morphex
# Or build from source
$ git clone https://github.com/pkmdev-sec/morphex.sh.git
$ cd morphex.sh && make build
# Scan your codebase
$ morphex scan . --deep
See It In Action
Every component below is a working demonstration of how MORPHEX processes, classifies, and verifies secrets.
The Alert Avalanche.
Traditional scanners don't understand context. They bury you in hundreds of false positives from tests, mocks, and examples.
Deep Obfuscation Detection
Developers (and attackers) hide secrets in ways that break traditional regex scanners. MORPHEX reconstructs the original secret before running it through the classification pipeline.
- String Concatenation
- Variable Interpolation
- Reversed Strings
- ROT13 Encoding
# String concatenation
prefix = "sk_live_"
key = prefix + "4eC39HqLyjWDarjtT1zdp7dc"
# Variable interpolation
base = "ghp_"
token = f"{base}ABCDEFghijklmnop1234567890"
# Reversed string
secret = "cd7pdz1TjraDjWyL9qH3Ce4_evil_ks"[::-1]# [MORPHEX: CONCATENATION RESOLVED]
prefix = "sk_live_"
sk_live_4eC39HqLyjWDarjtT1zdp7dc
# [MORPHEX: INTERPOLATION RESOLVED]
base = "ghp_"
ghp_ABCDEFghijklmnop1234567890
# [MORPHEX: REVERSAL DECODED]
sk_live_4eC3Hq9LyjWDarjt1zdp7dcThe Noise Matrix
Traditional scanners drown you in false positives. Watch as MORPHEX isolates the true signal from the noise.
The Provenance Pipeline
Every candidate walks through four stages. Only what survives all four gets reported.
1. EXTRACTION
Deep AST parsing reconstructs obfuscated strings.
key = prefix + "4eC3..."
2. SYNAPSE
Evaluates 5 contextual signals to determine confidence.
3. AVAT AGENT
Runs 7 independent filters to aggressively eliminate false positives.
4. VERIFICATION
Safely pings the target service API to verify the credential is live.
The Proof is in the Data
67 real-world repositories. Three scanners. MORPHEX finds what regex misses — and proves every finding is real.