js-secrets-extraction

Download the JS bundles referenced in the page HTML, then grep them with regex patterns for known key formats like AWS AKIA keys, Google AIza keys, JWTs, and Stripe tokens. The included scan_js.py script automates this by fetching a URL, extracting all JS bundle links, and scanning each against 13 secret patterns.

Fetch the .js.map file, parse its JSON, and write each entry in the sourcesContent array to a file named from the corresponding sources entry. This recovers the original pre-minification source, which often contains credentials and internal API paths removed from the minified output.

Yes, regex pattern matching works directly on minified bundles since secrets retain their literal values regardless of minification. However, source maps provide better context by revealing variable names and surrounding code, making false positive validation easier.

Generic patterns like 'secret' or 'token' match placeholder strings, example values, and public identifiers such as Vercel dpl_ deployment IDs. Validate each candidate by testing it against the corresponding API endpoint, such as calling the Firebase identity toolkit with a suspected API key.

Large bundles slow down naive scanning, rate limiting can interrupt bulk downloads, and server-side-only secrets never appear in client code. The scanner caps downloads at 15 bundles per page and works best combined with source map analysis and Wayback Machine historical JS files.