domains / families / security / hardcoded-credential-hunt

hardcoded-credential-hunt

separate

Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

When to use

• An application serves HTML forms with pre-filled or hidden password fields.
• A configuration endpoint (`/api/config`, `/env`, `/settings`) returns JSON with credential-like strings.
• A debug/error page leaks application secrets in JavaScript variables.
• An unauthenticated API endpoint returns data that controls authentication (reset, exit registration, admin actions).
• JavaScript bundles contain string assignments matching password patterns.

Skill page

Source