Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
2026-08-13

Vulnerability Scanning

Scan for Exposed Secrets

Pattern-match live HTTP responses for exposed secrets like API tokens and credentials. Reuses responses across searches to scan a URL fleet at once.

Agent

What Scan for Exposed Secrets does

Exposed secrets in live HTTP responses are API tokens and credentials left sitting in HTML or JSON that anyone fetching the URL can read. This module pattern-matches those response bodies across thousands of URLs in a single pass, reusing each response so the fleet is not fetched twice. It finds what is already leaking in the body you fetched, not what might be at a guessed path.

You feed a live URL list. The module fetches those HTTP responses, pattern-matches the bodies for tokens and credentials already sitting in HTML or JSON, and reuses each response across searches so the fleet is not re-fetched per pattern. It does not guess .env paths, unpack a JavaScript AST, walk git history, or call a vendor to prove a key still works. Flags live on tool pages; the hard problem here is matching the body you already have without claiming the key is live.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

Live URLs from Probe for Web Servers. Deeper page seeds from Discover Paths via Crawling and Discover Paths via Directory Brute Force.

Downstream

findings into Generate Scan Report.

Parallel

The other exposed-artifact modules on the same URL list: Scan for Exposed Admin Panels, Scan for Exposed Backups, and Scan for Sensitive Files. Each owns a different artifact class. Do not share one H1.

When to use this

Nest this after you have live web URLs and you want the tokens already leaking in the response you fetched, not a file at a guessed path. A root URL list covers whatever those URLs already return. Nested pages still need path discovery upstream.

Inputs and outputs

Required

  • urls (FILE): live HTTP URLs, one per line. Example: https://foo.example.com, https://bar.example.com/app.

Optional

  • header (STRING): header(s) to include in HTTP requests.

  • header-file (FILE): file of header(s) to include.

  • rate-limit (STRING): max requests per second per machine. Default 300.

  • findings: JSONLines of finding details. Published fields: finding, location, severity, hostname, domain_name, ip_address, method, matches, and (v1.2.1) the HTTP request that triggered the row. README examples: GitHub Personal Access Token (ghp_...) and OpenAI API Key (sk_...), both info severity until you triage.

Data

The tables this module produces. Sample rows are illustrative.

findings9 columns · 3 sample rows

Pattern matches for exposed secrets in live HTTP response bodies.

findingtext
locationurl
severitytext
hostnametext
domain_nametext
ip_addresstext
methodtext
matchestext
requesttext
1GitHub Personal Access Tokenhttps://app.example.com/index.htmlinfoapp.example.comexample.com203.0.113.10GETghp_<redacted>GET /index.html HTTP/1.1
2OpenAI API Keyhttps://api.example.com/status.jsoninfoapi.example.comexample.com203.0.113.20GETsk-<redacted>GET /status.json HTTP/1.1
3AWS Access Key IDhttps://cdn.example.com/config.jsinfocdn.example.comexample.com198.51.100.42GETAKIA<redacted>GET /config.js HTTP/1.1

How it differs from similar modules

Scan for Exposed Admin Panels

Artifact class it owns

Management / login UI; default creds on a subset

Upstream it needs

live urls

Scan for Exposed Backups

Artifact class it owns

Hostname-named .bak/.sql/zip/tarball

Upstream it needs

live urls

Scan for Exposed Secrets

Artifact class it owns

Patterns in the response you fetched

Upstream it needs

live urls

Scan for Sensitive Files

Artifact class it owns

.env, .git/config, logs, dev artifacts

Upstream it needs

live urls

questions

Scan for Exposed Secrets questions

No. [Scan GitHub for Leaked Secrets](/library/github-secret-scanner) reads commit history. [Analyze JavaScript Code](/library/modules/analyze-javascript-code) matches patterns in unpacked JS. [Find Secrets in Wayback Responses](/library/wayback-secrets-finder) reads archived bodies. This module pattern-matches live HTTP response bodies you already fetched. A key in `index.html` is this page. A key in `app.min.js` is the JS module. A key in git history is the GitHub workflow.

Related modules

  1. Scan for Exposed Admin Panels

  2. Scan for Exposed Backups

  3. Scan for Sensitive Files

  4. Discover Paths via Directory Brute Force

  5. Discover Paths via Crawling

  6. Discover Paths via OSINT Sources

  7. Scan GitHub for Leaked Secrets

  8. Find Secrets in Wayback Responses

  9. Analyze JavaScript Code

  10. trufflehog

    git history and vendor verification; not this job

  11. SecretFinder

    JS regex only; not live HTTP

Nest Scan for Exposed Secrets in a workflow

Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.

Build with Scan for Exposed SecretsBrowse modules

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demoExplore the platform