What is Loosewire?

Loosewire is a specialized static analysis security scanner designed specifically for payment gateway integrations. It inspects application source archives (.zip) and compiled Android packages (.apk) to detect implementation flaws that could allow an attacker to bypass payment verification, manipulate transaction amounts or extract private merchant credentials.

The crucial distinction: Loosewire is not a customer fraud-detection engine that evaluates whether a shopper or credit card is suspicious. Instead, it inspects the merchant's application codebase to ensure that backend handlers correctly verify cryptographic proofs, authenticate gateway callbacks and enforce transaction invariants before fulfilling orders.

Scanner Evaluation vs. Current Scan: When you open Loosewire, you will see published evaluation benchmarks (88.9% Precision, 100% Recall, 94.1% F1). These numbers describe Loosewire's own scanner accuracy across 19 benchmark fixtures. They are not findings from your project. Your project findings only appear after you run an active scan on the Scan tab. If no project has been uploaded, there are zero project findings and no fake project statistics.

What Does Loosewire Look For?

Modern checkout architectures split responsibilities between untrusted clients (browsers and mobile apps) and trusted server backends. Loosewire inspects code across four critical security checks:

1. Signature Verification

When a customer completes payment at a gateway modal, the gateway returns a cryptographic signature (an HMAC hash combining order ID and payment ID, signed with the merchant's secret key). The merchant backend must independently recalculate and verify this HMAC signature before trusting the payment.

The Risk: If the server merely accepts a payment_id from the client without verifying the HMAC signature, an adversary can send synthetic HTTP requests with fabricated IDs to mark orders as paid without executing a real transaction.

2. Webhook Verification

Webhooks are automated server-to-server HTTP notifications sent by payment gateways for asynchronous events (e.g. offline bank transfers clearing, subscription renewals or disputes). Because webhook endpoints are public HTTP URLs, anyone can post payloads to them. The receiving server must check the cryptographic signature in request headers against the webhook secret before processing the event.

3. Amount Validation & Integrity

Authenticating that a transaction occurred is not the same as verifying the transaction amount. If a backend fails to check that the captured payment amount matches the authoritative database price for that order, an attacker can modify client-side checkout parameters to pay $1 for an item priced at $500.

4. Secret Exposure

Payment gateways provide Public Keys (safe for frontend widgets) and Private Secrets (for backend server signing, refunds and transfers). Private secret keys must never be hardcoded into frontend scripts, HTML templates or mobile Android APK bytecode, where decompilation easily exposes them.

Understanding a Finding

When Loosewire analyzes your codebase, each identified security issue is presented with six standardized fields in the Findings workspace:

Evaluation Metrics & Full Forms

To evaluate how reliably Loosewire performs, we use standard classification metrics. You do not need any background in statistics or machine learning to understand them:

Core Classification Terms

Precision, Recall, and F1 Explained

The Held-Out Evaluation (19 Fixtures)

On the Metrics tab, you see published benchmark scores: 88.9% Precision, 100% Recall and 94.1% F1.

What does this mean? These are NOT metrics from your uploaded project. They measure Loosewire's scanner performance. They were calculated by testing Loosewire against an isolated test suite of 19 held-out evaluation fixtures (containing both clean and deliberately vulnerable checkout implementations) where expected findings were strictly partitioned during detector rule authoring.

Evaluation Results Breakdown:

The Estimated Value Model ($3,975)

The Metrics tab displays an Estimated Value Saved ($3,975) along with assumptions of $25 / false positive and $500 / false negative.

What is it?

It is an assumption-based cost model used to illustrate the potential financial value of catching security defects early versus manual triage overhead.

The Model Assumptions

How $3,975 is Calculated:

Using the evaluation results from the 19 benchmark fixtures (8 TP, 1 FP, 0 FN):

• • 8 True Positives detected × $500 avoided exposure = +$4,000
• • 1 False Positive raised × $25 triage overhead = -$25
• • 0 False Negatives missed × $500 exposure = -$0
• • Net Modeled Value = $4,000 - $25 = $3,975

The displayed $3,975 represents the difference between the modeled cost of Loosewire's evaluation outcome and a hypothetical zero-coverage baseline where no automated analysis is run.

Why Does This Model Exist?

The purpose of the Estimated Value Model is to translate abstract scanner performance statistics (precision and recall) into a simple, business-oriented estimate. It helps answer: "Why does improving detection accuracy matter?" It clearly illustrates the economic trade-off between the substantial benefits of catching vulnerabilities and the minor operational friction of reviewing false alarms.

What Loosewire Does Not Claim

Loosewire is an automated static analysis tool. A clean scan does not constitute a formal guarantee that an application is 100% secure. Comprehensive payment security requires a defense-in-depth posture including:

Safe & Authorized Use

Loosewire is intended for scanning source code and application packages that you own or have explicit authorization to audit.

All analysis is performed entirely locally on your machine using temporary memory directories. No source code, credentials, or findings are transmitted to external servers or retained after analysis completes.