Find the secrets your game build ships to players.
Xila scans Unity, Godot and Web/WebGL builds and reports what an attacker could extract: shipped credentials, backend misconfiguration, exposed endpoints and debug artefacts. It runs fully offline and uploads nothing.
go install github.com/xilasec/xila/cli/xila@latestWhat it finds
Shipped credentials
30 secret formats: cloud keys, database URLs, backend-as-a-service tokens, signing keys and game-backend secrets. Each one is redacted in the report.
Backend misconfiguration
Public Firebase/Firestore rules, wildcard CORS with credentials and disabled TLS verification shipped inside the build.
Exposed endpoints
Every URL, WebSocket and staging host the game talks to, so nothing points at a forgotten dev backend.
Debug artefacts
Development builds, remote debuggers and production source maps left enabled for players to read.
CI-native output
SARIF 2.1.0 for GitHub code scanning, plus JSON, Markdown and text. Baselines and severity gates included.
Offline and honest
No uploads, no telemetry. Secrets are redacted at evidence construction; an adjacent credential can never leak through a finding.
Supported builds
| Build | What Xila reads | Known limits |
|---|---|---|
| Unity (Mono and IL2CPP) | Managed and IL2CPP literals, native game-code strings, loose serialized assets, UnityFS bundles, StreamingAssets and configuration | No native disassembly or type-tree reconstruction; encrypted, obfuscated and legacy bundles are not decoded. |
| Godot 3/4 | Unencrypted PCK v1 to v4, scripts, project settings, embedded config | Encrypted PCKs and GDExtension not supported. |
| Unity WebGL / web | UnityWebData, gzip/Brotli bundles, JavaScript, source maps, wasm strings | No JavaScript data-flow; downloaded content is invisible offline. |
| Individual files | Text, configuration and reachable binary strings | No generic ZIP/APK/PAK/ASAR extractor yet. |
A clean scan means Xila analyzed the listed components. It does not prove a game is secure. See Trust and limitations.
Need more than a scanner?
The scanner reads your build. For the authoritative server, the backend and the economy, we also provide hands on security testing and audits for multiplayer games. If you are getting ready to launch, that is usually where the real risk is.
Or email xin@xila.us.
Drop it into CI without breaking builds
Start non-blocking, review the first report, then gate on new high-severity findings.