# Install cariddi with Homebrew, apk, Nix Scan for endpoints, secrets, API keys, file extensions, tokens and more. Version 1.4.6 via Homebrew; verified 2026-06-15. ## Install ```sh sudo av install brew:cariddi ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install cariddi ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add cariddi ``` Evidence: Alpine Linux edge package indexes: cariddi from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz - Nix (92%): ```sh nix profile install nixpkgs#cariddi ``` Evidence: nixpkgs package indexes: pkgs/by-name/ca/cariddi/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:cariddi - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.4.6 - **Source summary:** Scan for endpoints, secrets, API keys, file extensions, tokens and more - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-or-later - **Source archive:** - **Last updated:** 2026-06-15T10:20:11-04:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cariddi (cli) - cariddi (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.4.6 - Package-manager updated: 2026-06-15 - Local data: ok - Upstream repository: https://github.com/edoardottt/cariddi - Upstream latest detected: v1.4.6 (current) ## Project history and usage cariddi is a Go command-line web crawling and scanning tool for security reconnaissance. Its official README describes feeding it URLs or domains, then using flags to discover endpoints, secrets, API keys, file extensions, tokens, errors, and related web artifacts. ### Project history The public GitHub repository was created in 2021 under edoardottt/cariddi. The project presents itself as a small focused CLI rather than a service: install it with Go or a package manager, pipe targets into stdin, and compose flags for the kind of reconnaissance desired. ### Adoption history Official installation instructions list Homebrew, Snap, Go install, Pacman, NixOS, and source builds, while the input package facts also show packaging in Homebrew, apk, and Nix. That is the usual adoption shape for modern infosec CLIs: the tool lives upstream on GitHub, but package managers make it convenient to drop into bug bounty and automation environments. ### How it is used cariddi reads targets from stdin or a file and can scan one URL or many. The README documents modes for secret hunting, endpoint discovery, extension checks, error checks, useful-information extraction, JSON output, proxy use, custom headers, custom ignore lists, cache use, timeout control, concurrency, and depth limits. ### Why package nerds care For package-manager catalogs, cariddi is a representative Go security CLI: a single executable, broad install coverage, and behavior centered on Unix pipelines. Its value in a package index is that a reconnaissance workflow can depend on the packaged binary instead of a local Go checkout. ### Timeline - 2021: Public GitHub repository created. - 2020s: README documents Homebrew, Snap, Go install, Pacman, NixOS, and source-build installation paths. - 2020s: Package facts show availability through Homebrew, apk, and Nix. ### Related projects - Related package-manager neighbors are other bug-bounty and reconnaissance CLIs that accept URL lists on stdin and emit findings suitable for pipelines. - The README points users to Go for source builds and to shell-oriented package managers for installation. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cariddi - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - cariddi: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cariddi/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - cariddi - 1.4.5-r4: normalized package name match | Alpine Linux edge package indexes: cariddi from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | Crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more | https://github.com/edoardottt/cariddi ## Related links - [Package publisher tools](https://www.automicvault.com/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [csprecon](https://www.automicvault.com/pkg/brew/csprecon/) - Shares the same upstream homepage. - [favirecon](https://www.automicvault.com/pkg/brew/favirecon/) - Shares the same upstream homepage. - [scilla](https://www.automicvault.com/pkg/brew/scilla/) - Shares the same upstream homepage. - [cargo-make](https://www.automicvault.com/pkg/brew/cargo-make/) - Shares av.db curated category or tags: build-tool, cargo, cli, developer-tools, rust. - [cargo-auditable](https://www.automicvault.com/pkg/brew/cargo-auditable/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-binstall](https://www.automicvault.com/pkg/brew/cargo-binstall/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-binutils](https://www.automicvault.com/pkg/brew/cargo-binutils/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-bloat](https://www.automicvault.com/pkg/brew/cargo-bloat/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-bundle](https://www.automicvault.com/pkg/brew/cargo-bundle/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-c](https://www.automicvault.com/pkg/brew/cargo-c/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-cache](https://www.automicvault.com/pkg/brew/cargo-cache/) - Shares av.db curated category or tags: cargo, cli, developer-tools, rust. - [cargo-chef](https://www.automicvault.com/pkg/brew/cargo-chef/) - Both packages touch the same language runtime or ecosystem. Shared terms: build, cache, cargo, cli, developer. ## Combined YAML source View the package source record on GitHub. [combined/cariddi.yml](https://github.com/automic-vault/db/blob/main/combined/cariddi.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph