What does SecretFinder look for in JavaScript?

Sensitive data left in client-side code: API keys, access tokens, authorization headers, JWTs, and similar credentials, each matched by a named regular expression. It beautifies the script with jsbeautifier first, so minified and packed code still matches.

Does SecretFinder scan GitHub repositories or git history for leaked secrets?

No. It reads JavaScript served to the browser through a URL, a file, or a folder, not commit history. To find leaked API keys across a Git repository, reach for gitleaks or trufflehog; use SecretFinder for the live JS surface of an application.

How do I scan authenticated JavaScript?

Supply cookies with -c and headers with -H so scripts that load only for a logged-in session are fetched and included in the scan. Combine them with -e to walk every JavaScript link behind that session.

How does SecretFinder fit a static code analysis workflow?

It is a targeted static pass over JavaScript: no code runs, it matches regular expressions over beautified source. Wire it after a crawler such as katana harvests JS links, and route its file and folder outputs into the rest of a Trickest workflow for triage.

Can it follow every script on a live page?

Yes. Pass a URL with -i and add -e to extract each JavaScript link on the page and scan every one. Narrow the set with -n to process only URLs containing a string, or -g to ignore URLs that contain one.

Updated Jul 14, 2026

Static Code Analysis

Find API keys and secrets in JavaScript files

Python tool that discovers API keys, tokens, and other secrets inside JavaScript files.

Pull secrets out of client-side JS Extract and process every JS link Reach authenticated scripts

overview

What secretfinder does

SecretFinder digs through JavaScript files for sensitive data: API keys, access tokens, authorization values, JWTs, and similar secrets that developers leave in client-side code. Built on LinkFinder, it runs the Python jsbeautifier over a script and then applies a large regular expression to surface anything that looks like a credential.

It accepts a single file, a folder, or a remote URL, and it can extract every JavaScript link on a page and process each one. Cookies and headers let it reach authenticated scripts, a filtering regex narrows which endpoints count, and include and ignore string filters decide which JS URLs to process. It also reads Burp-exported files for offline review of captured traffic.

On Trickest, SecretFinder is a Static Code Analysis node that takes a file, folder, or URL and writes a file and a folder of findings. Run it after a crawler harvests JavaScript so the script surface of an app gets a dedicated secret sweep.

source github.com/m4ll0k/SecretFinder

use cases

Where secretfinder fits

Pull secrets out of client-side JS

Scan an app's JavaScript for API keys, tokens, JWTs, and authorization values that were shipped to the browser by mistake.

Extract and process every JS link

Point -e at a page so SecretFinder finds each JavaScript link and runs the secret scan on every one, instead of a single script at a time.

Reach authenticated scripts

Pass cookies with -c and headers with -H so scripts that only load for a logged-in session are fetched and scanned for secrets.

Review Burp-captured traffic

Feed a Burp-exported file with -b so JavaScript captured during a proxied session is scanned offline for leaked credentials.

reference

secretfinder inputs and flags

11 inputs

Name	Type	Flag	Description
input-string	STRING	-i	Input a URL to scan.
input-file	FILE	-i	Input a file to scan.
input-folder	FOLDER	-i	Input a folder of JavaScript to scan.
extract-all-js-links	BOOLEAN	-e	Extract all JavaScript links on a page and process them.
cookie	STRING	-c	Add cookies for authenticated JS files.
headers	STRING	-H	Set headers ("Name:Value\nName:Value").
filtering-regex	STRING	-r	RegEx to filter found endpoints (e.g. ^/api/).
support-burp-exported-file	BOOLEAN	-b	Support a Burp-exported file as input.

Showing key inputs. secretfinder exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
proxy	STRING	-p	Set proxy (host:port).
cookie	STRING	-c	Add cookies for authenticated JS files.
headers	STRING	-H	Set headers ("Name:Value\nName:Value").
input-file	FILE	-i	Input a file to scan.
input-folder	FOLDER	-i	Input a folder to scan.
input-string	STRING	-i	Input a URL to scan.
filtering-regex	STRING	-r	RegEx for filtering purposes against found endpoints (e.g. ^/api/).
only-process-this	STRING	-n	Process a JS URL only if it contains the provided string (string;string2..).
ignore-if-contains	STRING	-g	Ignore a JS URL if it contains the provided string (string;string2..).
extract-all-js-links	BOOLEAN	-e	Extract all JavaScript links located in a page and process them.
support-burp-exported-file	BOOLEAN	-b	Support a Burp-exported file as input.

example

Run secretfinder

secretfinder · command

# scan every JS link on a page, print findings to the terminalpython3 SecretFinder.py -i https://example.com/ -e -o cli

sample output

[ + ] URL: https://example.com/static/app.min.jsgoogle_api	->	['AIzaSyD-EXAMPLE0000000000000000000000000']aws_access_key	->	['AKIAEXAMPLE0000000000']authorization_bearer	->	['Bearer eyJhbGciOiJIUzI1NiEXAMPLE.payload.sig'][ + ] URL: https://example.com/static/vendor.jsheroku_api_key	->	['00000000-0000-0000-0000-000000000000']slack_token	->	['xoxb-000000000000-EXAMPLE00000000000000']possible_creds	->	['password = "changeme-example"']

guidance

Choosing secretfinder

Reach for SecretFinder when the secrets you care about live in JavaScript files served to the browser. For secrets across Git history use reposcanner or gitleaks; for vulnerable JS library versions rather than leaked keys, Retire.js is the right tool.

linkfinder

The base project SecretFinder extends, focused on extracting endpoints from JS.

rex

Runs custom regex rules across a directory or repository rather than JS specifically.

retire-js

Finds vulnerable JavaScript library versions instead of leaked secrets in JS.

faq

secretfinder questions

Call the script with an input and an output mode: python3 SecretFinder.py -i https://example.com/ -o cli. The -i value can be a URL, a file, or a folder, and -e pulls and scans every JavaScript link on a page. On Trickest, set the node's input instead of typing the -i flag.

Run secretfinder yourself

A set of JavaScript URLs feeds SecretFinder, which beautifies and regex-scans each one and writes any leaked secrets as a queryable output.

Run secretfinder in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

input-string

STRING

-i

Input a URL to scan.

input-file

FILE

-i

Input a file to scan.

input-folder

FOLDER

-i

Input a folder of JavaScript to scan.

extract-all-js-links

BOOLEAN

-e

Extract all JavaScript links on a page and process them.

STRING

-c

Add cookies for authenticated JS files.

headers

STRING

-H

Set headers ("Name:Value\nName:Value").

filtering-regex

STRING

-r

RegEx to filter found endpoints (e.g. ^/api/).

support-burp-exported-file

BOOLEAN

-b

Support a Burp-exported file as input.

Name

Type

Flag

Description

proxy

STRING

-p

Set proxy (host:port).

STRING

-c

Add cookies for authenticated JS files.

headers

STRING

-H

Set headers ("Name:Value\nName:Value").

input-file

FILE

-i

Input a file to scan.

input-folder

FOLDER

-i

Input a folder to scan.

input-string

STRING

-i

Input a URL to scan.

filtering-regex

STRING

-r

RegEx for filtering purposes against found endpoints (e.g. ^/api/).

only-process-this

STRING

-n

Process a JS URL only if it contains the provided string (string;string2..).

ignore-if-contains

STRING

-g

Ignore a JS URL if it contains the provided string (string;string2..).

extract-all-js-links

BOOLEAN

-e

Extract all JavaScript links located in a page and process them.

support-burp-exported-file

BOOLEAN

-b

Support a Burp-exported file as input.

[ + ] URL: https://example.com/static/app.min.jsgoogle_api -> ['AIzaSyD-EXAMPLE0000000000000000000000000']aws_access_key -> ['AKIAEXAMPLE0000000000']authorization_bearer -> ['Bearer eyJhbGciOiJIUzI1NiEXAMPLE.payload.sig'][ + ] URL: https://example.com/static/vendor.jsheroku_api_key -> ['00000000-0000-0000-0000-000000000000']slack_token -> ['xoxb-000000000000-EXAMPLE00000000000000']possible_creds -> ['password = "changeme-example"']

Find API keys and secrets in JavaScript files

What secretfinder does

Where secretfinder fits

Pull secrets out of client-side JS

Extract and process every JS link

Reach authenticated scripts

Review Burp-captured traffic

secretfinder inputs and flags

Run secretfinder

Choosing secretfinder

linkfinder

rex

retire-js

secretfinder questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run secretfinder yourself

Find API keys and secrets in JavaScript files

What secretfinder does

Where secretfinder fits

Pull secrets out of client-side JS

Extract and process every JS link

Reach authenticated scripts

Review Burp-captured traffic

secretfinder inputs and flags

Run secretfinder

Choosing secretfinder

linkfinder

rex

retire-js

secretfinder questions

More Static Code Analysis tools

bandit

dawnscanner

dumpsterdiver

dvcsripper-git

git-log4j

gitleaks

Run secretfinder yourself