Static Code Analysis
Scan client-side JS for leaked API keys and JWTs
secretfinder is an open-source Python tool, built on LinkFinder, that discovers sensitive data in JavaScript files such as API keys, access tokens, authorization headers, and JWTs, using jsbeautifier together with targeted regular expressions.
installgit clone https://github.com/m4ll0k/SecretFinder.gitcd SecretFinderpip3 install -r requirements.txt
Python · GPL-3.0 license
overview
What secretfinder does
SecretFinder scans JavaScript for sensitive data left in client-side code: API keys, access tokens, authorization values, JWTs, and similar credentials. It beautifies scripts with jsbeautifier, then matches a large regular expression set.
Pass -i a URL, file, or folder. -e extracts every JavaScript link on a page and processes each one. -c and -H reach authenticated scripts, -r filters endpoints, and -b reads Burp-exported captures offline.
Run it after a crawler harvests JS when the secrets you care about live in browser-served scripts. For Git history leaks use gitleaks; for vulnerable library versions use Retire.js.
use cases
Where secretfinder fits
Pull secrets out of client-side JS
Scan an app's JavaScript for API keys, tokens, JWTs, and authorization values that were shipped to the browser by mistake.
Extract and process every JS link
Point -e at a page so SecretFinder finds each JavaScript link and runs the secret scan on every one, instead of a single script at a time.
Reach authenticated scripts
Pass cookies with -c and headers with -H so scripts that only load for a logged-in session are fetched and scanned for secrets.
Review Burp-captured traffic
Feed a Burp-exported file with -b so JavaScript captured during a proxied session is scanned offline for leaked credentials.
reference
secretfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-string | STRING | -i | Input a URL to scan. |
| input-file | FILE | -i | Input a file to scan. |
| input-folder | FOLDER | -i | Input a folder of JavaScript to scan. |
| extract-all-js-links | BOOLEAN | -e | Extract all JavaScript links on a page and process them. |
| cookie | STRING | -c | Add cookies for authenticated JS files. |
| headers | STRING | -H | Set headers ("Name:Value\nName:Value"). |
| filtering-regex | STRING | -r | RegEx to filter found endpoints (e.g. ^/api/). |
| support-burp-exported-file | BOOLEAN | -b | Support a Burp-exported file as input. |
Showing key inputs. secretfinder exposes 11 inputs in total.
Full flag reference (11 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| proxy | STRING | -p | Set proxy (host:port). |
| cookie | STRING | -c | Add cookies for authenticated JS files. |
| headers | STRING | -H | Set headers ("Name:Value\nName:Value"). |
| input-file | FILE | -i | Input a file to scan. |
| input-folder | FOLDER | -i | Input a folder to scan. |
| input-string | STRING | -i | Input a URL to scan. |
| filtering-regex | STRING | -r | RegEx for filtering purposes against found endpoints (e.g. ^/api/). |
| only-process-this | STRING | -n | Process a JS URL only if it contains the provided string (string;string2..). |
| ignore-if-contains | STRING | -g | Ignore a JS URL if it contains the provided string (string;string2..). |
| extract-all-js-links | BOOLEAN | -e | Extract all JavaScript links located in a page and process them. |
| support-burp-exported-file | BOOLEAN | -b | Support a Burp-exported file as input. |
example
Run secretfinder
# scan every JS link on a page, print findings to the terminal
python3 SecretFinder.py -i https://example.com/ -e -o cli[ + ] URL: https://example.com/static/app.min.js
google_api -> ['AIzaSyD-EXAMPLE0000000000000000000000000']
aws_access_key -> ['AKIAEXAMPLE0000000000']
authorization_bearer -> ['Bearer eyJhbGciOiJIUzI1NiEXAMPLE.payload.sig']
[ + ] URL: https://example.com/static/vendor.js
heroku_api_key -> ['00000000-0000-0000-0000-000000000000']
slack_token -> ['xoxb-000000000000-EXAMPLE00000000000000']
possible_creds -> ['password = "changeme-example"']guidance
Choosing secretfinder
Reach for SecretFinder when the secrets you care about live in JavaScript served to the browser. For secrets across Git history use gitleaks; for vulnerable JS library versions rather than leaked keys, Retire.js fits better.
linkfinder
Base project SecretFinder extends; focused on extracting endpoints from JS.
rex
Runs custom regex rules across a directory or repository rather than JS specifically.
retire-js
Finds vulnerable JavaScript library versions instead of leaked secrets in JS.
faq
secretfinder questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run secretfinder yourself
A set of JavaScript URLs feeds SecretFinder, which beautifies and regex-scans each one and writes any leaked secrets as a queryable output.
Facts on this page come from the live Trickest tool library.