Know exactly what your app talks to. You shipped code. But do you actually know every external service it calls? Every raw HTTP endpoint, every third-party SDK, every API key that quietly ended up hardcoded in a source file? Sonar is a local-only macOS app that statically scans the source of your own iOS and web projects and builds a complete inventory of every external API call — raw HTTP endpoints plus third-party SDK usage — and flags possible hardcoded secrets in client source. It runs entirely on your machine. No account. No telemetry. No cloud. Read-only — Sonar never modifies your source. Why developers use Sonar • Catch leaked secrets before your users do. Sonar flags possible hardcoded API keys and tokens sitting in client source, where anyone can extract them from a shipped binary or bundle. • Build a real API inventory. Stop guessing which services your app depends on — get a concrete list of every endpoint and SDK in use, perfect for audits, handoffs, and "what does this actually call?" moments. • Stay private by design. Your source code never leaves your Mac. The only network call Sonar ever makes is a one-time license check. • Make it yours. Detection is driven by editable JSON rule packs. Out of the box Sonar knows Supabase, Stripe, Firebase, Anthropic, OpenAI, Replicate, ElevenLabs, Resend, DocuSign, and Google — and you can add any service you want. Features • Static, on-device scan of your project source — nothing is uploaded • Inventories raw HTTP endpoints and third-party SDK usage • Flags possible hardcoded secrets in client source • Config-driven detection via editable JSON rule packs • Built-in detectors for Supabase, Stripe, Firebase, Anthropic, OpenAI, Replicate, ElevenLabs, Resend, DocuSign, Google — plus any service you add • Parses Swift and JavaScript / TypeScript today • Incremental rescans — only re-process what changed • Read-only — Sonar never modifies your source • No account, no telemetry, no tracking • Apple-notarized direct-download .dmg Who it's for • iOS and web developers who want a clear picture of every external dependency in their codebase • Indie devs and small teams doing a pre-release security pass without heavyweight tooling • Freelancers and agencies auditing an inherited project or preparing a clean handoff • Privacy-conscious engineers who refuse to upload proprietary source to a third-party scanner How it works 1. Download the notarized .dmg and drag Sonar to Applications. 2. Point it at one of your own projects. 3. Sonar scans the source on-device and produces an inventory of API calls, SDKs, and possible secrets. 4. Edit the JSON rule packs to teach it any service you like, then rescan incrementally. Try it free for 14 days. When you're ready, paste your Gumroad license key into the app to unlock it permanently. FAQ Do you see my code? Never. Sonar is 100% local. The only network call the app ever makes is a single license-key verification to Gumroad — no source code or file contents are ever sent. Is there a free trial? Yes — 14 days, full functionality. After that, enter your license key to keep using it. Refund policy? Because there's a full 14-day trial before you pay, all sales are final. Email hello@nyrai.ai if anything isn't working. Requirements? macOS 13 (Ventura) or later, Apple Silicon or Intel. Updates? Yes — your key unlocks current and future releases. Languages? Swift and JavaScript / TypeScript today; rules are extensible via JSON. Published by NYRAI LLC · hello@nyrai.ai