domains / families / security / client-secret-exposure-audit

client-secret-exposure-audit

authentic

Audit a deployed web app for secrets exposed to the browser: hardcoded API keys/tokens in JS, secrets in HTML meta/attributes/comments, publicly reachable source/config/deploy files, and header/CORS misconfig.

When to use

• Use when you need to check whether a deployed site leaks API keys, tokens, or
• Use when working with a static/SPA deployment (Vercel, Netlify, Nginx, S3,
• Use when the user asks to "find secrets," "audit exposed files," "check the
• Do **not** use this to attack third-party sites. See *Security & Safety Notes*.

When not to use

• Read-only reconnaissance of client-served assets; it does not test injection,
• Path probing uses a wordlist; it finds common exposures, not every file.
• This skill does not replace environment-specific validation, testing, or expert
• Stop and ask for clarification if authorization, scope, or safety boundaries

Skill page

Source