Surface Watch
Watch a web app's client-side attack surface change between builds
Capture each target of a pentest engagement with REA and see its attack surface: endpoints, parameters, statuses, security headers and third parties. Compare two builds without the noise of renamed chunks and timing, turn what matters into findings backed by evidence, and retest to see whether each one is fixed. Runs fully local, with a command line for scheduled watches.
Free for personal, research and non-profit use, with one engagement and every tab, the command line and scheduled watches. Commercial use, including a consultant on client work, requires Surface Watch Pro, which also keeps any number of engagements. Every build is produced by release CI and served from mayorana.ch.
The macOS build is signed with an Apple Developer ID and notarized, so it opens with a normal double-click.
Read the release notesThis app is in beta. The core workflow is stable; some panels are still being refined.
One-time purchase, including a year of updates. Secure payment by Stripe; your licence key is shown right after and sent by email.
Overview
A web app under test changes every sprint. Comparing two builds by hand means wading through renamed script chunks, images and timing differences to find the one new endpoint that matters, and remembering which findings were fixed since the last visit.
Surface Watch captures each target of an engagement with REA and turns the traffic into a surface: every endpoint with its parameters and statuses, the security headers, the scripts and the third parties the page talks to. Entries worth a look, such as server errors, admin paths that answer without a login or pages without a Content-Security-Policy, are flagged first.
Compare any two captures and see only what changed, each change with what it means for your testing. Findings cite the raw REA evidence they rest on, and a retest says whether each one is fixed. Everything runs on your computer and no LLM is involved.
What it does
The surface, not the traffic
Endpoints with their parameters, statuses and security headers, plus scripts and third-party origins. Suspicious entries are flagged and listed first.
Diffs without the noise
Renamed chunks, images and timing never show up as changes. A stability check captures the build twice and sets aside endpoints that come and go between runs.
Findings with evidence
Promote any entry or change to a finding. Each one cites the REA evidence it rests on, and a retest records whether it is fixed.
Engagements that stay in scope
Each engagement records the client, who authorised the test and its test window. Captures outside the window are refused, and origins are checked as you type.
Desktop and command line
The surfacewatch CLI shares the same core, for scheduled watches from cron or CI, HAR imports and checks over SSH.
Requirements
- macOS (Apple Silicon), Windows 10 or 11, or Linux x86_64
- Node.js 22.19+, 24.11+ or 26+
- REA: a global rea if installed, otherwise it is run through npx
- Google Chrome, Chromium or Edge
- Written authorisation for every target you capture
Built with
Rust · Dioxus · REA · Node.js · Chrome
What's new
Version 0.1.6, released 19 October 2026. Surface Watch ships often; every version and what it changed is listed on the release notes page.
Read the release notesLicence
Source-available under the PolyForm Noncommercial License 1.0.0: free for personal use, learning, research and hobby projects, and for charities, schools, universities and government institutions, with one engagement and every feature. Commercial use, including a consultant on client work and an employee using it at their job, requires Surface Watch Pro, which also keeps any number of engagements. Pro is the commercial licence: there is nothing else to buy.
Source
The source is public and readable. Fork it and rebrand it — the name and logo are trademarks and are not covered by the licence.
View on GitHubQuestions
What is REA?
REA is the open-source tool Surface Watch drives to open each target in a browser and record what it does. Surface Watch keeps REA's raw evidence unchanged and builds the surface and the diffs on top of it.
Does anything leave my computer?
No. Captures, surfaces, findings and engagements are kept in private files on your computer. Surface Watch talks only to the targets you capture, and no AI model is involved.
Can I capture any website?
Only targets you are authorised to test. Every engagement needs an authorisation note and a test window, and captures outside that window are refused.
Questions about this tool?
Ask about a commercial licence for your team, report an issue, or tell us what is missing. We read every message.
Get in touch