skills.rest
jd-opensource
jd-opensourceOFFICIAL
Explore all skills by this author →
WebsiteGitHub

pentest-secrets-exposure

Detect hardcoded credentials and exposed secrets in source code and artifacts.

299|56|Updated Jan 13, 2026
Search Tags:#automation#secrets#credentials#pentest#security-testing#exposure
One-click install
npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-secrets-exposure
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pentest-secrets-exposure
Source: https://github.com/jd-opensource/JoySafeter/tree/main/skills/pentest-secrets-exposure
Command: npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-secrets-exposure

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps identify hardcoded credentials, leaked API keys, exposed configuration files, and sensitive data in artifacts, reducing the risk of data leakage across codebases and deployments.

Core Features & Use Cases

  • Source code secrets scanning with pattern and history analysis to detect hardcoded keys and credentials.
  • Exposed configuration and backup file discovery across repositories and deployments.
  • Information leakage testing through error handling disclosures and verbose traces.
  • Client-side bundle analysis to surface secrets in JavaScript and web assets.
  • Validation & reporting to document secret types, locations, scope, and blast radius for remediation.

Quick Start

Scan your codebase to uncover hardcoded credentials, leaked keys, and exposed configuration files.

Frequently Asked Questions about pentest-secrets-exposure

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for hardcoded credentials and exposed secrets?▼

Scanning source code for hardcoded credentials involves analyzing code patterns and repository history to detect exposed keys. This skill automates discovery across codebases and deployments to reduce data leakage risks.

What is the best way to find leaked API keys in client-side JavaScript bundles?▼

Finding leaked API keys in client-side bundles requires analyzing web assets and JavaScript files for sensitive data. This skill performs client-side bundle analysis to surface secrets hidden in frontend code.

Does this secrets exposure testing require TruffleHog or GitLeaks to run?▼

Yes, validating exposed secrets and performing history analysis requires TruffleHog, GitLeaks, Semgrep, and nuclei-like tooling. These dependencies enable deep code history scanning and configuration file discovery.

Can I test for information leakage through verbose error handling disclosures?▼

Yes, you can test for information leakage by checking error handling disclosures and verbose traces. This skill identifies sensitive data exposed through application errors and stack traces.

How do I document the blast radius of exposed configuration files and backup data?▼

Documenting the blast radius of exposed configuration files involves validating findings and reporting secret types, locations, and scope. This skill outputs remediation reports detailing the exact exposure impact.

Related Skills

Explore More Software Engineering Skills→
yangqiongyangqiong

CI/CD Pipeline Skill

Generate automated CI/CD pipeline configurations in YAML for GitHub Actions and GitLab CI/CD.

Community
Advanced
JayRHaJayRHa
3

secrets-manager

Detect, prevent, and remediate leaked credentials across codebases.

Community
Advanced
nikhillinitnikhillinit

security-scanner

Detect security vulnerabilities, secrets, and misconfigurations in codebases.

Community
Advanced
DuqueOMDuqueOM
5

security-audit

Detect security flaws in code, configurations, and containers before deployment.

Community
Advanced