domains / families / security / js-secrets-extraction

js-secrets-extraction

separate

Analyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints

When to use

• **ALWAYS** after initial web enumeration
• When you find modern SPA (React, Angular, Vue)
• When target uses Firebase, Supabase, Auth0
• Higher yield than directory scanning on many targets

Skill page

Source