Find the secrets your game build ships to players.
Xila scans Unity, Godot and Web/WebGL builds and reports what an attacker could extract: shipped credentials, backend misconfiguration, exposed endpoints and debug artefacts. It runs fully offline and uploads nothing.
go install github.com/xila-sec/xila/cli/xila@latestWhat it finds
Shipped credentials
30 secret formats: cloud keys, database URLs, backend-as-a-service tokens, signing keys and game-backend secrets — each redacted in the report.
Backend misconfiguration
Public Firebase/Firestore rules, wildcard CORS with credentials and disabled TLS verification shipped inside the build.
Exposed endpoints
Every URL, WebSocket and staging host the game talks to, so nothing points at a forgotten dev backend.
Debug artefacts
Development builds, remote debuggers and production source maps left enabled for players to read.
CI-native output
SARIF 2.1.0 for GitHub code scanning, plus JSON, Markdown and text. Baselines and severity gates included.
Offline and honest
No uploads, no telemetry. Secrets are redacted at evidence construction; an adjacent credential can never leak through a finding.
Supported builds
| Build | What Xila reads | Known limits |
|---|---|---|
| Unity (Mono) | Assemblies, string heaps, native files, StreamingAssets, configuration | No IL decompilation or serialized-asset decoding yet. |
| Godot 3/4 | Unencrypted PCK v1–4, scripts, project settings, embedded config | Encrypted PCKs and GDExtension not supported. |
| Unity WebGL / web | UnityWebData, gzip/Brotli bundles, JavaScript, source maps, wasm strings | No JavaScript data-flow; downloaded content is invisible offline. |
| Individual files | Text, configuration and reachable binary strings | No generic ZIP/APK/PAK/ASAR extractor yet. |
A clean scan means Xila analyzed the listed components — it does not prove a game is secure. See Trust & limitations.
Drop it into CI without breaking builds
Start non-blocking, review the first report, then gate on new high-severity findings.