The live exposure filter
A source scanner hands you two hundred findings and no way to know which ones matter first. This tool takes any SARIF report (Snyk, Semgrep, SonarQube, CodeQL, anything that exports SARIF 2.1.0), runs a free read-only scan of your deployed app, and sorts the report's finding classes by one question: is this actually exposed to the outside world right now?
How the matching works, honestly
The join is by vulnerability class, using the CWE tags and rule text in your SARIF file, matched against the checks xlogs can actually run from outside: exposed secrets, missing headers, source disclosure, sensitive files, data access control, and untrusted third-party scripts. It never claims a specific source finding equals a specific live finding, and it never re-judges your scanner's work.
Most source findings (SQL injection, XSS, logic bugs) cannot be seen from outside a running app at all. Those are labelled "not observable from outside", which is a limit of the method, stated as one, not a verdict that they are fine.
Your report stays yours
The SARIF file is parsed in your browser and never uploaded. The only thing sent to xlogs is your app's URL, which runs the same free scan as the homepage, under the same rules: read-only, no account, nothing stored. See the privacy policy.