What problem does it solve? Front-end bundles and source maps expose API routes, role checks, hidden parameters, and hardcoded credentials, but manually reading minified JavaScript is slow and regex-only secret scanning misses credentials returned from functions rather than assigned to variables. ## Core Features & Use Cases - Source Map Recovery: Harvests bundle URLs, validates .map files across the whole file (avoiding the prefix-check bug that silently discards large application maps), and reconstructs original first-party source while filtering vendor noise. - Two-Pass Secret Detection: Combines a 67-rule regex bank with a secret-named-identifier proximity pass and a Shannon entropy sweep to catch credentials that assignment-based patterns miss. - Trust-Mismatch Analysis: Converts recovered routes, feature flags, role checks, and hidden parameters into a manual test queue focused on actor, state, and helper-endpoint differences. - Use Case: During a web application assessment, recover 5,000+ original source files from deployed source maps, surface a live client secret the regex bank missed, and validate it against its issuer before reporting. ## Quick Start Analyze the target application's JavaScript bundles and source maps to build an endpoint map, recover hardcoded secrets, and generate a prioritized manual test queue.
